{"api_version":"v1","coverage_note":"Downloaded CISA KEV catalog plus CVEs identified in monitored sources; not the entire CVE universe. Enrichment may be incomplete.","data":[{"affected":[{"product":"vSomeIp","vendor":"COVESA","versions":[{"lessThan":"3.7.4","status":"affected","version":"v3.6.1","versionType":"custom"}]}],"cna":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2026-11-12T22:10:19.636Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"url":"https://www.kb.cert.org/vuls/id/128947"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"vSomeIp","vendor":"COVESA","versions":[{"lessThan":"3.7.4","status":"affected","version":"v3.6.1","versionType":"custom"}]}],"descriptions":[{"lang":"en","value":"A vulnerability in the default configuration of vsomeip allows a remote, unauthenticated attacker to trigger massive memory allocations by sending a small TCP packet with a large, attacker-declared SOME/IP length field. This can lead to immediate service termination via OOM-kill on memory-constrained systems or total host memory exhaustion through repeated connections."}],"problemTypes":[{"descriptions":[{"description":"CWE-1284","lang":"en"}]},{"descriptions":[{"description":"CWE-789","lang":"en"}]},{"descriptions":[{"description":"CWE-400","lang":"en"}]}],"providerMetadata":{"dateUpdated":"2026-11-12T21:13:23.814Z","orgId":"37e5125f-f79b-445b-8fad-9564f167944b","shortName":"certcc"},"references":[{"url":"https://kb.cert.org/vuls/id/128947"},{"url":"https://biackr0se.github.io/posts/cve-2026-91141-vsomeip/"}],"source":{"discovery":"UNKNOWN"},"title":"CVE-2026-91141","x_generator":{"engine":"VINCE 4.0.3","env":"prod","origin":"https://cveawg.mitre.org/api/cve/CVE-2026-91141"}}},"cveMetadata":{"assignerOrgId":"37e5125f-f79b-445b-8fad-9564f167944b","assignerShortName":"certcc","cveId":"CVE-2026-91141","datePublished":"2026-11-12T21:13:23.814Z","dateReserved":"2026-09-14T20:30:18.834Z","dateUpdated":"2026-11-12T22:10:19.636Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794522003,"cve":"CVE-2026-91141","description":"A vulnerability in the default configuration of vsomeip allows a remote, unauthenticated attacker to trigger massive memory allocations by sending a small TCP packet with a large, attacker-declared SOME/IP length field. This can lead to immediate service termination via OOM-kill on memory-constrained systems or total host memory exhaustion through repeated connections.","epss":null,"epss_checked":0,"first_seen":1793665374,"kev":null,"kev_checked":1794522003,"products":"COVESA vSomeIp","references":["https://kb.cert.org/vuls/id/128947","https://biackr0se.github.io/posts/cve-2026-91141-vsomeip/","https://www.kb.cert.org/vuls/id/128947"],"score":null,"solutions":"","state":"PUBLISHED","title":"CVE-2026-91141","updated_at":1794522003,"url":"https://www.clawpit.io/egret/cves/CVE-2026-91141","workarounds":""},{"affected":[{"product":".NET 8.0 installed on Linux","vendor":"Microsoft","versions":[{"lessThan":"8.0.34","status":"affected","version":"8.0.0","versionType":"custom"}]},{"product":".NET 8.0 installed on Mac OS","vendor":"Microsoft","versions":[{"lessThan":"8.0.34","status":"affected","version":"8.0.0","versionType":"custom"}]},{"product":".NET 8.0 installed on Windows","vendor":"Microsoft","versions":[{"lessThan":"8.0.34","status":"affected","version":"8.0.0","versionType":"custom"}]},{"product":".NET 9.0 installed on Linux","vendor":"Microsoft","versions":[{"lessThan":"9.0.0-preview.4.24266.19","status":"affected","version":"9.0.0","versionType":"custom"}]},{"product":".NET 9.0 installed on Mac OS","vendor":"Microsoft","versions":[{"lessThan":"9.0.0-preview.4.24266.19","status":"affected","version":"9.0.0","versionType":"custom"}]},{"product":".NET 9.0 installed on Windows","vendor":"Microsoft","versions":[{"lessThan":"9.0.0-preview.4.24266.19","status":"affected","version":"9.0.0","versionType":"custom"}]},{"product":"Microsoft Visual Studio 2022 version 17.14","vendor":"Microsoft","versions":[{"lessThan":"17.14.45","status":"affected","version":"17.14.0","versionType":"custom"}]},{"product":"Microsoft Visual Studio 2026 version 18.11","vendor":"Microsoft","versions":[{"lessThan":"18.11.4","status":"affected","version":"18.11.0","versionType":"custom"}]},{"product":"Microsoft Visual Studio 2026 version 18.12","vendor":"Microsoft","versions":[{"lessThan":"18.12.0","status":"affected","version":"18.12.0","versionType":"custom"}]}],"cna":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-109478","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:49:14.082894Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-11-10T20:50:39.980Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":".NET 8.0 installed on Linux","vendor":"Microsoft","versions":[{"lessThan":"8.0.34","status":"affected","version":"8.0.0","versionType":"custom"}]},{"product":".NET 8.0 installed on Mac OS","vendor":"Microsoft","versions":[{"lessThan":"8.0.34","status":"affected","version":"8.0.0","versionType":"custom"}]},{"product":".NET 8.0 installed on Windows","vendor":"Microsoft","versions":[{"lessThan":"8.0.34","status":"affected","version":"8.0.0","versionType":"custom"}]},{"product":".NET 9.0 installed on Linux","vendor":"Microsoft","versions":[{"lessThan":"9.0.0-preview.4.24266.19","status":"affected","version":"9.0.0","versionType":"custom"}]},{"product":".NET 9.0 installed on Mac OS","vendor":"Microsoft","versions":[{"lessThan":"9.0.0-preview.4.24266.19","status":"affected","version":"9.0.0","versionType":"custom"}]},{"product":".NET 9.0 installed on Windows","vendor":"Microsoft","versions":[{"lessThan":"9.0.0-preview.4.24266.19","status":"affected","version":"9.0.0","versionType":"custom"}]},{"product":"Microsoft Visual Studio 2022 version 17.14","vendor":"Microsoft","versions":[{"lessThan":"17.14.45","status":"affected","version":"17.14.0","versionType":"custom"}]},{"product":"Microsoft Visual Studio 2026 version 18.11","vendor":"Microsoft","versions":[{"lessThan":"18.11.4","status":"affected","version":"18.11.0","versionType":"custom"}]},{"product":"Microsoft Visual Studio 2026 version 18.12","vendor":"Microsoft","versions":[{"lessThan":"18.12.0","status":"affected","version":"18.12.0","versionType":"custom"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:microsoft:.net_9.0_installed_on_linux:*:*:*:*:*:*:*:*","versionEndExcluding":"9.0.0-preview.4.24266.19","versionStartIncluding":"9.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net_9.0_installed_on_mac_os:*:*:*:*:*:*:*:*","versionEndExcluding":"9.0.0-preview.4.24266.19","versionStartIncluding":"9.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net_9.0_installed_on_windows:*:*:*:*:*:*:*:*","versionEndExcluding":"9.0.0-preview.4.24266.19","versionStartIncluding":"9.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net_8.0_installed_on_windows:*:*:*:*:*:*:*:*","versionEndExcluding":"8.0.34","versionStartIncluding":"8.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net_8.0_installed_on_linux:*:*:*:*:*:*:*:*","versionEndExcluding":"8.0.34","versionStartIncluding":"8.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net_8.0_installed_on_mac_os:*:*:*:*:*:*:*:*","versionEndExcluding":"8.0.34","versionStartIncluding":"8.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*","versionEndExcluding":"17.14.45","versionStartIncluding":"17.14.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:microsoft_visual_studio_2026_version_18.11:*:*:*:*:*:*:*:*","versionEndExcluding":"18.11.4","versionStartIncluding":"18.11.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:microsoft_visual_studio_2026_version_18.12:*:*:*:*:*:*:*:*","versionEndExcluding":"18.12.0","versionStartIncluding":"18.12.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"datePublic":"2026-11-10T16:00:00.000Z","descriptions":[{"lang":"en-US","value":"Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network."}],"metrics":[{"cvssV3_1":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-407","description":"CWE-407: Inefficient Algorithmic Complexity","lang":"en-US","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-12T21:42:34.182Z","orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","shortName":"microsoft"},"references":[{"name":"ASP.NET Core Denial of Service Vulnerability","tags":["vendor-advisory","patch"],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109478"}],"title":"ASP.NET Core Denial of Service Vulnerability"}},"cveMetadata":{"assignerOrgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","assignerShortName":"microsoft","cveId":"CVE-2026-109478","datePublished":"2026-11-10T18:15:23.710Z","dateReserved":"2026-10-12T17:01:11.371Z","dateUpdated":"2026-11-12T21:42:34.182Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794522003,"cve":"CVE-2026-109478","description":"Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.","epss":{"date":"2026-11-12","epss":0.01245,"percentile":0.69693},"epss_checked":1794522003,"first_seen":1794376805,"kev":null,"kev_checked":1794522003,"products":"Microsoft .NET 8.0 installed on Linux, Microsoft .NET 8.0 installed on Mac OS, Microsoft .NET 8.0 installed on Windows, Microsoft .NET 9.0 installed on Linux, Microsoft .NET 9.0 installed on Mac OS, Microsoft .NET 9.0 installed on Windows, Microsoft Microsoft Visual Studio 2022 version 17.14, Microsoft Microsoft Visual Studio 2026 version 18.11, Microsoft Microsoft Visual Studio 2026 version 18.12","references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109478"],"score":{"baseScore":7.5,"baseSeverity":"HIGH","provider":"microsoft","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C","version":"3.1"},"solutions":"","state":"PUBLISHED","title":"ASP.NET Core Denial of Service Vulnerability","updated_at":1794522003,"url":"https://www.clawpit.io/egret/cves/CVE-2026-109478","workarounds":""},{"affected":[{"product":".NET 10.0 installed on Linux","vendor":"Microsoft","versions":[{"lessThan":"10.0.15","status":"affected","version":"10.0.0","versionType":"custom"}]},{"product":".NET 10.0 installed on Mac OS","vendor":"Microsoft","versions":[{"lessThan":"10.0.15","status":"affected","version":"10.0.0","versionType":"custom"}]},{"product":".NET 10.0 installed on Windows","vendor":"Microsoft","versions":[{"lessThan":"10.0.15","status":"affected","version":"10.0.0","versionType":"custom"}]},{"product":".NET 11.0 installed on Linux","vendor":"Microsoft","versions":[{"lessThan":"11.0.0","status":"affected","version":"11.0.0-preview.1","versionType":"custom"}]},{"product":".NET 11.0 installed on Mac OS","vendor":"Microsoft","versions":[{"lessThan":"11.0.0","status":"affected","version":"11.0.0-preview.1","versionType":"custom"}]},{"product":".NET 11.0 installed on Windows","vendor":"Microsoft","versions":[{"lessThan":"11.0.0","status":"affected","version":"11.0.0-preview.1","versionType":"custom"}]},{"product":".NET 8.0 installed on Linux","vendor":"Microsoft","versions":[{"lessThan":"8.0.34","status":"affected","version":"8.0.0","versionType":"custom"}]},{"product":".NET 8.0 installed on Mac OS","vendor":"Microsoft","versions":[{"lessThan":"8.0.34","status":"affected","version":"8.0.0","versionType":"custom"}]},{"product":".NET 8.0 installed on Windows","vendor":"Microsoft","versions":[{"lessThan":"8.0.34","status":"affected","version":"8.0.0","versionType":"custom"}]},{"product":".NET 9.0 installed on Linux","vendor":"Microsoft","versions":[{"lessThan":"9.0.23","status":"affected","version":"9.0.0","versionType":"custom"}]},{"product":".NET 9.0 installed on Mac OS","vendor":"Microsoft","versions":[{"lessThan":"9.0.23","status":"affected","version":"9.0.0","versionType":"custom"}]},{"product":".NET 9.0 installed on Windows","vendor":"Microsoft","versions":[{"lessThan":"9.0.23","status":"affected","version":"9.0.0","versionType":"custom"}]},{"product":"Microsoft Visual Studio 2022 version 17.14","vendor":"Microsoft","versions":[{"lessThan":"17.14.45","status":"affected","version":"17.14.0","versionType":"custom"}]},{"product":"Microsoft Visual Studio 2026 version 18.11","vendor":"Microsoft","versions":[{"lessThan":"18.11.4","status":"affected","version":"18.11.0","versionType":"custom"}]},{"product":"Microsoft Visual Studio 2026 version 18.12","vendor":"Microsoft","versions":[{"lessThan":"18.12.0","status":"affected","version":"18.12.0","versionType":"custom"}]}],"cna":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-109476","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:46:32.602081Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-11-10T21:51:57.261Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":".NET 10.0 installed on Linux","vendor":"Microsoft","versions":[{"lessThan":"10.0.15","status":"affected","version":"10.0.0","versionType":"custom"}]},{"product":".NET 10.0 installed on Mac OS","vendor":"Microsoft","versions":[{"lessThan":"10.0.15","status":"affected","version":"10.0.0","versionType":"custom"}]},{"product":".NET 10.0 installed on Windows","vendor":"Microsoft","versions":[{"lessThan":"10.0.15","status":"affected","version":"10.0.0","versionType":"custom"}]},{"product":".NET 11.0 installed on Linux","vendor":"Microsoft","versions":[{"lessThan":"11.0.0","status":"affected","version":"11.0.0-preview.1","versionType":"custom"}]},{"product":".NET 11.0 installed on Mac OS","vendor":"Microsoft","versions":[{"lessThan":"11.0.0","status":"affected","version":"11.0.0-preview.1","versionType":"custom"}]},{"product":".NET 11.0 installed on Windows","vendor":"Microsoft","versions":[{"lessThan":"11.0.0","status":"affected","version":"11.0.0-preview.1","versionType":"custom"}]},{"product":".NET 8.0 installed on Linux","vendor":"Microsoft","versions":[{"lessThan":"8.0.34","status":"affected","version":"8.0.0","versionType":"custom"}]},{"product":".NET 8.0 installed on Mac OS","vendor":"Microsoft","versions":[{"lessThan":"8.0.34","status":"affected","version":"8.0.0","versionType":"custom"}]},{"product":".NET 8.0 installed on Windows","vendor":"Microsoft","versions":[{"lessThan":"8.0.34","status":"affected","version":"8.0.0","versionType":"custom"}]},{"product":".NET 9.0 installed on Linux","vendor":"Microsoft","versions":[{"lessThan":"9.0.23","status":"affected","version":"9.0.0","versionType":"custom"}]},{"product":".NET 9.0 installed on Mac OS","vendor":"Microsoft","versions":[{"lessThan":"9.0.23","status":"affected","version":"9.0.0","versionType":"custom"}]},{"product":".NET 9.0 installed on Windows","vendor":"Microsoft","versions":[{"lessThan":"9.0.23","status":"affected","version":"9.0.0","versionType":"custom"}]},{"product":"Microsoft Visual Studio 2022 version 17.14","vendor":"Microsoft","versions":[{"lessThan":"17.14.45","status":"affected","version":"17.14.0","versionType":"custom"}]},{"product":"Microsoft Visual Studio 2026 version 18.11","vendor":"Microsoft","versions":[{"lessThan":"18.11.4","status":"affected","version":"18.11.0","versionType":"custom"}]},{"product":"Microsoft Visual Studio 2026 version 18.12","vendor":"Microsoft","versions":[{"lessThan":"18.12.0","status":"affected","version":"18.12.0","versionType":"custom"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:microsoft:.net_8.0_installed_on_windows:*:*:*:*:*:*:*:*","versionEndExcluding":"8.0.34","versionStartIncluding":"8.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net_8.0_installed_on_linux:*:*:*:*:*:*:*:*","versionEndExcluding":"8.0.34","versionStartIncluding":"8.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net_8.0_installed_on_mac_os:*:*:*:*:*:*:*:*","versionEndExcluding":"8.0.34","versionStartIncluding":"8.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net_9.0_installed_on_windows:*:*:*:*:*:*:*:*","versionEndExcluding":"9.0.23","versionStartIncluding":"9.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net_9.0_installed_on_linux:*:*:*:*:*:*:*:*","versionEndExcluding":"9.0.23","versionStartIncluding":"9.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net_9.0_installed_on_mac_os:*:*:*:*:*:*:*:*","versionEndExcluding":"9.0.23","versionStartIncluding":"9.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net_10.0_installed_on_windows:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.15","versionStartIncluding":"10.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net_10.0_installed_on_linux:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.15","versionStartIncluding":"10.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net_10.0_installed_on_mac_os:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.15","versionStartIncluding":"10.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net_11.0_installed_on_windows:*:*:*:*:*:*:*:*","versionEndExcluding":"11.0.0","versionStartIncluding":"11.0.0-preview.1","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net_11.0_installed_on_linux:*:*:*:*:*:*:*:*","versionEndExcluding":"11.0.0","versionStartIncluding":"11.0.0-preview.1","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net_11.0_installed_on_mac_os:*:*:*:*:*:*:*:*","versionEndExcluding":"11.0.0","versionStartIncluding":"11.0.0-preview.1","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*","versionEndExcluding":"17.14.45","versionStartIncluding":"17.14.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:microsoft_visual_studio_2026_version_18.11:*:*:*:*:*:*:*:*","versionEndExcluding":"18.11.4","versionStartIncluding":"18.11.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:microsoft_visual_studio_2026_version_18.12:*:*:*:*:*:*:*:*","versionEndExcluding":"18.12.0","versionStartIncluding":"18.12.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"datePublic":"2026-11-10T16:00:00.000Z","descriptions":[{"lang":"en-US","value":"Improper encoding or escaping of output in ASP.NET Core allows an unauthorized attacker to disclose information over a network."}],"metrics":[{"cvssV3_1":{"baseScore":6.1,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-116","description":"CWE-116: Improper Encoding or Escaping of Output","lang":"en-US","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-12T21:42:33.589Z","orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","shortName":"microsoft"},"references":[{"name":"ASP.NET Core Information Disclosure Vulnerability","tags":["vendor-advisory","patch"],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109476"}],"title":"ASP.NET Core Information Disclosure Vulnerability"}},"cveMetadata":{"assignerOrgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","assignerShortName":"microsoft","cveId":"CVE-2026-109476","datePublished":"2026-11-10T18:15:23.121Z","dateReserved":"2026-10-12T17:01:11.371Z","dateUpdated":"2026-11-12T21:42:33.589Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794522003,"cve":"CVE-2026-109476","description":"Improper encoding or escaping of output in ASP.NET Core allows an unauthorized attacker to disclose information over a network.","epss":{"date":"2026-11-12","epss":0.00637,"percentile":0.51037},"epss_checked":1794522003,"first_seen":1794376805,"kev":null,"kev_checked":1794522003,"products":"Microsoft .NET 10.0 installed on Linux, Microsoft .NET 10.0 installed on Mac OS, Microsoft .NET 10.0 installed on Windows, Microsoft .NET 11.0 installed on Linux, Microsoft .NET 11.0 installed on Mac OS, Microsoft .NET 11.0 installed on Windows, Microsoft .NET 8.0 installed on Linux, Microsoft .NET 8.0 installed on Mac OS, Microsoft .NET 8.0 installed on Windows, Microsoft .NET 9.0 installed on Linux, Microsoft .NET 9.0 installed on Mac OS, Microsoft .NET 9.0 installed on Windows, Microsoft Microsoft Visual Studio 2022 version 17.14, Microsoft Microsoft Visual Studio 2026 version 18.11, Microsoft Microsoft Visual Studio 2026 version 18.12","references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109476"],"score":{"baseScore":6.1,"baseSeverity":"MEDIUM","provider":"microsoft","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C","version":"3.1"},"solutions":"","state":"PUBLISHED","title":"ASP.NET Core Information Disclosure Vulnerability","updated_at":1794522003,"url":"https://www.clawpit.io/egret/cves/CVE-2026-109476","workarounds":""},{"affected":[{"product":".NET 10.0 installed on Linux","vendor":"Microsoft","versions":[{"lessThan":"10.0.15","status":"affected","version":"10.0.0","versionType":"custom"}]},{"product":".NET 10.0 installed on Mac OS","vendor":"Microsoft","versions":[{"lessThan":"10.0.15","status":"affected","version":"10.0.0","versionType":"custom"}]},{"product":".NET 11.0 installed on Linux","vendor":"Microsoft","versions":[{"lessThan":"11.0.0","status":"affected","version":"11.0.0-preview.1","versionType":"custom"}]},{"product":".NET 11.0 installed on Mac OS","vendor":"Microsoft","versions":[{"lessThan":"11.0.0","status":"affected","version":"11.0.0-preview.1","versionType":"custom"}]},{"product":".NET 8.0 installed on Linux","vendor":"Microsoft","versions":[{"lessThan":"8.0.34","status":"affected","version":"8.0.0","versionType":"custom"}]},{"product":".NET 8.0 installed on Mac OS","vendor":"Microsoft","versions":[{"lessThan":"8.0.34","status":"affected","version":"8.0.0","versionType":"custom"}]},{"product":".NET 9.0 installed on Linux","vendor":"Microsoft","versions":[{"lessThan":"9.0.23","status":"affected","version":"9.0.0","versionType":"custom"}]},{"product":".NET 9.0 installed on Mac OS","vendor":"Microsoft","versions":[{"lessThan":"9.0.23","status":"affected","version":"9.0.0","versionType":"custom"}]}],"cna":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-109475","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:46:43.748724Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-11-10T21:51:57.417Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":".NET 10.0 installed on Linux","vendor":"Microsoft","versions":[{"lessThan":"10.0.15","status":"affected","version":"10.0.0","versionType":"custom"}]},{"product":".NET 10.0 installed on Mac OS","vendor":"Microsoft","versions":[{"lessThan":"10.0.15","status":"affected","version":"10.0.0","versionType":"custom"}]},{"product":".NET 11.0 installed on Linux","vendor":"Microsoft","versions":[{"lessThan":"11.0.0","status":"affected","version":"11.0.0-preview.1","versionType":"custom"}]},{"product":".NET 11.0 installed on Mac OS","vendor":"Microsoft","versions":[{"lessThan":"11.0.0","status":"affected","version":"11.0.0-preview.1","versionType":"custom"}]},{"product":".NET 8.0 installed on Linux","vendor":"Microsoft","versions":[{"lessThan":"8.0.34","status":"affected","version":"8.0.0","versionType":"custom"}]},{"product":".NET 8.0 installed on Mac OS","vendor":"Microsoft","versions":[{"lessThan":"8.0.34","status":"affected","version":"8.0.0","versionType":"custom"}]},{"product":".NET 9.0 installed on Linux","vendor":"Microsoft","versions":[{"lessThan":"9.0.23","status":"affected","version":"9.0.0","versionType":"custom"}]},{"product":".NET 9.0 installed on Mac OS","vendor":"Microsoft","versions":[{"lessThan":"9.0.23","status":"affected","version":"9.0.0","versionType":"custom"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:microsoft:.net_10.0_installed_on_mac_os:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.15","versionStartIncluding":"10.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net_11.0_installed_on_mac_os:*:*:*:*:*:*:*:*","versionEndExcluding":"11.0.0","versionStartIncluding":"11.0.0-preview.1","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net_8.0_installed_on_mac_os:*:*:*:*:*:*:*:*","versionEndExcluding":"8.0.34","versionStartIncluding":"8.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net_9.0_installed_on_mac_os:*:*:*:*:*:*:*:*","versionEndExcluding":"9.0.23","versionStartIncluding":"9.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net_8.0_installed_on_linux:*:*:*:*:*:*:*:*","versionEndExcluding":"8.0.34","versionStartIncluding":"8.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net_9.0_installed_on_linux:*:*:*:*:*:*:*:*","versionEndExcluding":"9.0.23","versionStartIncluding":"9.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net_10.0_installed_on_linux:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.15","versionStartIncluding":"10.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net_11.0_installed_on_linux:*:*:*:*:*:*:*:*","versionEndExcluding":"11.0.0","versionStartIncluding":"11.0.0-preview.1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"datePublic":"2026-11-10T16:00:00.000Z","descriptions":[{"lang":"en-US","value":"Stack-based buffer overflow in .NET allows an unauthorized attacker to deny service over a network."}],"metrics":[{"cvssV3_1":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-121","description":"CWE-121: Stack-based Buffer Overflow","lang":"en-US","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-12T21:42:33.079Z","orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","shortName":"microsoft"},"references":[{"name":".NET Denial of Service Vulnerability","tags":["vendor-advisory","patch"],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109475"}],"title":".NET Denial of Service Vulnerability"}},"cveMetadata":{"assignerOrgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","assignerShortName":"microsoft","cveId":"CVE-2026-109475","datePublished":"2026-11-10T18:15:22.540Z","dateReserved":"2026-10-12T17:01:11.371Z","dateUpdated":"2026-11-12T21:42:33.079Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794522003,"cve":"CVE-2026-109475","description":"Stack-based buffer overflow in .NET allows an unauthorized attacker to deny service over a network.","epss":{"date":"2026-11-12","epss":0.01279,"percentile":0.70407},"epss_checked":1794522003,"first_seen":1794376805,"kev":null,"kev_checked":1794522003,"products":"Microsoft .NET 10.0 installed on Linux, Microsoft .NET 10.0 installed on Mac OS, Microsoft .NET 11.0 installed on Linux, Microsoft .NET 11.0 installed on Mac OS, Microsoft .NET 8.0 installed on Linux, Microsoft .NET 8.0 installed on Mac OS, Microsoft .NET 9.0 installed on Linux, Microsoft .NET 9.0 installed on Mac OS","references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109475"],"score":{"baseScore":7.5,"baseSeverity":"HIGH","provider":"microsoft","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C","version":"3.1"},"solutions":"","state":"PUBLISHED","title":".NET Denial of Service Vulnerability","updated_at":1794522003,"url":"https://www.clawpit.io/egret/cves/CVE-2026-109475","workarounds":""},{"affected":[{"product":".NET 10.0 installed on Linux","vendor":"Microsoft","versions":[{"lessThan":"10.0.404","status":"affected","version":"10.0.0","versionType":"custom"}]},{"product":".NET 10.0 installed on Mac OS","vendor":"Microsoft","versions":[{"lessThan":"10.0.404","status":"affected","version":"10.0.0","versionType":"custom"}]},{"product":".NET 10.0 installed on Windows","vendor":"Microsoft","versions":[{"lessThan":"10.0.404","status":"affected","version":"10.0.0","versionType":"custom"}]},{"product":".NET 11.0 installed on Linux","vendor":"Microsoft","versions":[{"lessThan":"11.0.100","status":"affected","version":"11.0.0-preview.1","versionType":"custom"}]},{"product":".NET 11.0 installed on Mac OS","vendor":"Microsoft","versions":[{"lessThan":"11.0.100","status":"affected","version":"11.0.0-preview.1","versionType":"custom"}]},{"product":".NET 11.0 installed on Windows","vendor":"Microsoft","versions":[{"lessThan":"11.0.100","status":"affected","version":"11.0.0-preview.1","versionType":"custom"}]},{"product":".NET 8.0 installed on Linux","vendor":"Microsoft","versions":[{"lessThan":"8.0.428","status":"affected","version":"8.0.0","versionType":"custom"}]},{"product":".NET 8.0 installed on Mac OS","vendor":"Microsoft","versions":[{"lessThan":"8.0.428","status":"affected","version":"8.0.0","versionType":"custom"}]},{"product":".NET 8.0 installed on Windows","vendor":"Microsoft","versions":[{"lessThan":"8.0.428","status":"affected","version":"8.0.0","versionType":"custom"}]},{"product":".NET 9.0 installed on Linux","vendor":"Microsoft","versions":[{"lessThan":"9.0.321","status":"affected","version":"9.0.0","versionType":"custom"}]},{"product":".NET 9.0 installed on Mac OS","vendor":"Microsoft","versions":[{"lessThan":"9.0.321","status":"affected","version":"9.0.0","versionType":"custom"}]},{"product":".NET 9.0 installed on Windows","vendor":"Microsoft","versions":[{"lessThan":"9.0.321","status":"affected","version":"9.0.0","versionType":"custom"}]},{"product":"Microsoft Visual Studio 2022 version 17.14","vendor":"Microsoft","versions":[{"lessThan":"17.14.45","status":"affected","version":"17.14.0","versionType":"custom"}]},{"product":"Microsoft Visual Studio 2026 version 18.11","vendor":"Microsoft","versions":[{"lessThan":"18.11.4","status":"affected","version":"18.11.0","versionType":"custom"}]},{"product":"Microsoft Visual Studio 2026 version 18.12","vendor":"Microsoft","versions":[{"lessThan":"18.12.0","status":"affected","version":"18.12.0","versionType":"custom"}]},{"product":"Microsoft.TestPlatform.CLI","vendor":"Microsoft","versions":[{"lessThan":"18.11.1","status":"affected","version":"17.2.0","versionType":"custom"}]}],"cna":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-105544","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:06:05.419818Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-11-10T21:11:11.680Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":".NET 10.0 installed on Linux","vendor":"Microsoft","versions":[{"lessThan":"10.0.404","status":"affected","version":"10.0.0","versionType":"custom"}]},{"product":".NET 10.0 installed on Mac OS","vendor":"Microsoft","versions":[{"lessThan":"10.0.404","status":"affected","version":"10.0.0","versionType":"custom"}]},{"product":".NET 10.0 installed on Windows","vendor":"Microsoft","versions":[{"lessThan":"10.0.404","status":"affected","version":"10.0.0","versionType":"custom"}]},{"product":".NET 11.0 installed on Linux","vendor":"Microsoft","versions":[{"lessThan":"11.0.100","status":"affected","version":"11.0.0-preview.1","versionType":"custom"}]},{"product":".NET 11.0 installed on Mac OS","vendor":"Microsoft","versions":[{"lessThan":"11.0.100","status":"affected","version":"11.0.0-preview.1","versionType":"custom"}]},{"product":".NET 11.0 installed on Windows","vendor":"Microsoft","versions":[{"lessThan":"11.0.100","status":"affected","version":"11.0.0-preview.1","versionType":"custom"}]},{"product":".NET 8.0 installed on Linux","vendor":"Microsoft","versions":[{"lessThan":"8.0.428","status":"affected","version":"8.0.0","versionType":"custom"}]},{"product":".NET 8.0 installed on Mac OS","vendor":"Microsoft","versions":[{"lessThan":"8.0.428","status":"affected","version":"8.0.0","versionType":"custom"}]},{"product":".NET 8.0 installed on Windows","vendor":"Microsoft","versions":[{"lessThan":"8.0.428","status":"affected","version":"8.0.0","versionType":"custom"}]},{"product":".NET 9.0 installed on Linux","vendor":"Microsoft","versions":[{"lessThan":"9.0.321","status":"affected","version":"9.0.0","versionType":"custom"}]},{"product":".NET 9.0 installed on Mac OS","vendor":"Microsoft","versions":[{"lessThan":"9.0.321","status":"affected","version":"9.0.0","versionType":"custom"}]},{"product":".NET 9.0 installed on Windows","vendor":"Microsoft","versions":[{"lessThan":"9.0.321","status":"affected","version":"9.0.0","versionType":"custom"}]},{"product":"Microsoft Visual Studio 2022 version 17.14","vendor":"Microsoft","versions":[{"lessThan":"17.14.45","status":"affected","version":"17.14.0","versionType":"custom"}]},{"product":"Microsoft Visual Studio 2026 version 18.11","vendor":"Microsoft","versions":[{"lessThan":"18.11.4","status":"affected","version":"18.11.0","versionType":"custom"}]},{"product":"Microsoft Visual Studio 2026 version 18.12","vendor":"Microsoft","versions":[{"lessThan":"18.12.0","status":"affected","version":"18.12.0","versionType":"custom"}]},{"product":"Microsoft.TestPlatform.CLI","vendor":"Microsoft","versions":[{"lessThan":"18.11.1","status":"affected","version":"17.2.0","versionType":"custom"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:microsoft:.net_8.0_installed_on_windows:*:*:*:*:*:*:*:*","versionEndExcluding":"8.0.428","versionStartIncluding":"8.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net_8.0_installed_on_linux:*:*:*:*:*:*:*:*","versionEndExcluding":"8.0.428","versionStartIncluding":"8.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net_8.0_installed_on_mac_os:*:*:*:*:*:*:*:*","versionEndExcluding":"8.0.428","versionStartIncluding":"8.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net_9.0_installed_on_windows:*:*:*:*:*:*:*:*","versionEndExcluding":"9.0.321","versionStartIncluding":"9.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net_9.0_installed_on_linux:*:*:*:*:*:*:*:*","versionEndExcluding":"9.0.321","versionStartIncluding":"9.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net_9.0_installed_on_mac_os:*:*:*:*:*:*:*:*","versionEndExcluding":"9.0.321","versionStartIncluding":"9.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net_10.0_installed_on_windows:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.404","versionStartIncluding":"10.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net_10.0_installed_on_linux:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.404","versionStartIncluding":"10.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net_10.0_installed_on_mac_os:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.404","versionStartIncluding":"10.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net_11.0_installed_on_windows:*:*:*:*:*:*:*:*","versionEndExcluding":"11.0.100","versionStartIncluding":"11.0.0-preview.1","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net_11.0_installed_on_linux:*:*:*:*:*:*:*:*","versionEndExcluding":"11.0.100","versionStartIncluding":"11.0.0-preview.1","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net_11.0_installed_on_mac_os:*:*:*:*:*:*:*:*","versionEndExcluding":"11.0.100","versionStartIncluding":"11.0.0-preview.1","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*","versionEndExcluding":"17.14.45","versionStartIncluding":"17.14.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:microsoft_visual_studio_2026_version_18.11:*:*:*:*:*:*:*:*","versionEndExcluding":"18.11.4","versionStartIncluding":"18.11.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:microsoft_visual_studio_2026_version_18.12:*:*:*:*:*:*:*:*","versionEndExcluding":"18.12.0","versionStartIncluding":"18.12.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:microsoft.testplatform.cli:*:*:*:*:*:*:*:*","versionEndExcluding":"18.11.1","versionStartIncluding":"17.2.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"datePublic":"2026-11-10T16:00:00.000Z","descriptions":[{"lang":"en-US","value":"Improper access control in .NET allows an authorized attacker to elevate privileges locally."}],"metrics":[{"cvssV3_1":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-15","description":"CWE-15: External Control of System or Configuration Setting","lang":"en-US","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-12T21:42:23.750Z","orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","shortName":"microsoft"},"references":[{"name":".NET Elevation of Privilege Vulnerability","tags":["vendor-advisory","patch"],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105544"}],"title":".NET Elevation of Privilege Vulnerability"}},"cveMetadata":{"assignerOrgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","assignerShortName":"microsoft","cveId":"CVE-2026-105544","datePublished":"2026-11-10T18:15:12.518Z","dateReserved":"2026-10-05T16:02:13.154Z","dateUpdated":"2026-11-12T21:42:23.750Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794522003,"cve":"CVE-2026-105544","description":"Improper access control in .NET allows an authorized attacker to elevate privileges locally.","epss":{"date":"2026-11-12","epss":0.00336,"percentile":0.27389},"epss_checked":1794522003,"first_seen":1794376805,"kev":null,"kev_checked":1794522003,"products":"Microsoft .NET 10.0 installed on Linux, Microsoft .NET 10.0 installed on Mac OS, Microsoft .NET 10.0 installed on Windows, Microsoft .NET 11.0 installed on Linux, Microsoft .NET 11.0 installed on Mac OS, Microsoft .NET 11.0 installed on Windows, Microsoft .NET 8.0 installed on Linux, Microsoft .NET 8.0 installed on Mac OS, Microsoft .NET 8.0 installed on Windows, Microsoft .NET 9.0 installed on Linux, Microsoft .NET 9.0 installed on Mac OS, Microsoft .NET 9.0 installed on Windows, Microsoft Microsoft Visual Studio 2022 version 17.14, Microsoft Microsoft Visual Studio 2026 version 18.11, Microsoft Microsoft Visual Studio 2026 version 18.12, Microsoft Microsoft.TestPlatform.CLI","references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105544"],"score":{"baseScore":7.5,"baseSeverity":"HIGH","provider":"microsoft","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C","version":"3.1"},"solutions":"","state":"PUBLISHED","title":".NET Elevation of Privilege Vulnerability","updated_at":1794522003,"url":"https://www.clawpit.io/egret/cves/CVE-2026-105544","workarounds":""},{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/tun.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e0d98aab41b79b88609f33fb4d8e7a80ab8f648d","status":"affected","version":"ca6bb5d7ab22ac79f608fe6cbc6b12de6a5a19f0","versionType":"git"},{"lessThan":"2f92c0286cfd58bff9d6d54c01a771073d5eb775","status":"affected","version":"ca6bb5d7ab22ac79f608fe6cbc6b12de6a5a19f0","versionType":"git"},{"lessThan":"e53d1cf05da8ea58a5743b7ce5894fb51b0b9700","status":"affected","version":"ca6bb5d7ab22ac79f608fe6cbc6b12de6a5a19f0","versionType":"git"},{"lessThan":"ffdf678dd16610e3f006dac904bd37c09684673c","status":"affected","version":"ca6bb5d7ab22ac79f608fe6cbc6b12de6a5a19f0","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/tun.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.18"},{"lessThan":"2.6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.117","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.61","versionType":"semver"},{"lessThanOrEqual":"7.3.*","status":"unaffected","version":"7.3.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.4-rc1","versionType":"original_commit_for_fix"}]}],"cna":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/tun.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e0d98aab41b79b88609f33fb4d8e7a80ab8f648d","status":"affected","version":"ca6bb5d7ab22ac79f608fe6cbc6b12de6a5a19f0","versionType":"git"},{"lessThan":"2f92c0286cfd58bff9d6d54c01a771073d5eb775","status":"affected","version":"ca6bb5d7ab22ac79f608fe6cbc6b12de6a5a19f0","versionType":"git"},{"lessThan":"e53d1cf05da8ea58a5743b7ce5894fb51b0b9700","status":"affected","version":"ca6bb5d7ab22ac79f608fe6cbc6b12de6a5a19f0","versionType":"git"},{"lessThan":"ffdf678dd16610e3f006dac904bd37c09684673c","status":"affected","version":"ca6bb5d7ab22ac79f608fe6cbc6b12de6a5a19f0","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/tun.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.18"},{"lessThan":"2.6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.117","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.61","versionType":"semver"},{"lessThanOrEqual":"7.3.*","status":"unaffected","version":"7.3.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.4-rc1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.117","versionStartIncluding":"2.6.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.61","versionStartIncluding":"2.6.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3.2","versionStartIncluding":"2.6.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.4-rc1","versionStartIncluding":"2.6.18","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntun: Require CAP_NET_ADMIN to attach to an ownerless device\n\nTwenty years ago I made creating a tuntap device require CAP_NET_ADMIN\nin commit ca6bb5d7ab22 (\"[NET]: Require CAP_NET_ADMIN to create tuntap\ndevices.\")\n\nThe idea was to allow the permissions on /dev/net/tun to be relaxed to\n0666 and thus allow owners of tun devices assigned with TUNSETOWNER to\nactually open it and get at their devices.\n\nWhat we missed at the time was that persistent devices with *no* owner\nwere already essentially world-consumable, and anyone who could open\nthe device node could also attach to those.\n\nEven then, using persistent devices with no explicitly set owner — on\nthe (false) presumption that CAP_NET_ADMIN would be required to open\nthem — wasn't an egregious userspace bug. There are cases where it does\nmake sense to separate the creation/configuration of the netdevice, from\nthe process which shovels packets into it.\n\nSince then, TUNSETGROUP was added a year later in commit 8c644623fe7e\n(\"[NET]: Allow group ownership of TUN/TAP devices.\"). Its commit message\nnoted that if both uid and gid are set, both have to match (in itself a\nbizarre choice) — but still not that with *neither* set, no permission\nat all was required.\n\nThen in 2012 commit c8d68e6be1c3 (\"tuntap: multiqueue support\") allowed\nnew queues to be attached to a device from the moment of its creation,\nwith no way for userspace to close the race between creation and a\nsubsequent TUNSET{OWNER,GROUP}.\n\nIn 2024, commit 3ca459eaba1bf (\"tun: fix group permission check\") tried\nto fix things to be saner: only require the user *or* the group to\nmatch, in line with standard POSIX permissions, and require\nCAP_NET_ADMIN if neither the user nor group authorised the access\n(although it put the CAP_NET_ADMIN check first, and would wrongly have\nreported the capability as having been used even when it was not).\n\nThat fix was reverted in commit a70c7b3cbc06 (\"tun: revert fix group\npermission check\") due to allegedly causing a regression in an selinux\ntest suite which *expected* the attachment to succeed when authorised\nby none of user, group, nor CAP_NET_ADMIN:\nhttps://lore.kernel.org/netdev/CAFqZXNtkCBT4f+PwyVRmQGoT3p1eVa01fCG_aNtpt6dakXncUg@mail.gmail.com/\n\nWe should not break UAPI. But we don't have to consider an selinux test\ncase which deliberately exercises a security flaw to be UAPI worth\npreserving either. To which end, I have fixed it in selinux-testsuite\ncommit b2f894f0016b (\"tests/tun_tap: set an owner on the device for the\nrelabel tests\").\n\nSo: fix the lack of CAP_NET_ADMIN check on devices which *haven't* been\nassigned an owner or group, while leaving the weird tun ownership model\nas it was (user *and* group have to match, if both are set). If someone\nstill wants to fix the latter (which wasn't actually the reason the\nprevious attempt was reverted), they can do it under separate cover.\n\nPermit attaching to an existing device only if an owner and/or group was\nset and the caller matches all that were set, or if the caller has\nCAP_NET_ADMIN. The only behavioural change is that a device with no\nowner or group now requires CAP_NET_ADMIN to attach — precisely the\nloophole we want to close.\n\nAnd put the CAP_NET_ADMIN check in the right place this time."}],"metrics":[{"cvssV3_1":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - The attacker reaches the patched check by opening /dev/net/tun in tun_chr_open and issuing TUNSETIFF; __tun_chr_ioctl copies the ifreq and tun_set_iff looks the device up with __dev_get_by_name. The triggering input is that ioctl, on the ownerless branch of the old tun_not_capable predicate.\nAC:L - tun_setup stores INVALID_UID and INVALID_GID, so the old tun_not_capable predicate is false with no race. After the creator of an IFF_PERSIST device closes it, numqueues is 0 and tun_attach from TUNSETIFF succeeds on every try; an IFF_MULTI_QUEUE device accepts another queue the same way.\nPR:L - The ownerless path in the old tun_not_capable returns false without calling ns_capable(net->user_ns, CAP_NET_ADMIN). tun_chr_open has no capability check, and /dev/net/tun is mode 0666, so any local user can issue that TUNSETIFF. The caller is an unprivileged local user.\nUI:N - The attacker alone opens /dev/net/tun and passes the interface name to TUNSETIFF. That ioctl is the whole trigger.\nS:U - tun_chr_open binds the fd to current->nsproxy->net_ns, and tun_set_iff attaches only a device in that net. The impact is that namespace's tun packet queue and the tun ioctls on the resulting fd, under the same security authority as the caller.\nC:H - tun_net_xmit queues the device's egress skbs on the attached tfile, and tun_chr_read_iter, tun_do_read, and tun_put_user copy each full skb to the attacker. On a single-queue device that is every packet the host transmits on that interface.\nI:H - tun_chr_write_iter calls tun_get_user, which copies the attacker buffer into an skb, sets skb->dev, and injects it through netif_rx as ingress. On that same fd, __tun_chr_ioctl handles SIOCSIFHWADDR, TUNSETTXFILTER, TUNSETOWNER, and set_offload with no further capability check.\nA:H - Once numqueues is 1, a non-multiqueue tun_attach returns -EBUSY, so the legitimate opener cannot reclaim the device. TUNSETCARRIER calls netif_carrier_off, and TUNSETPERSIST(0) followed by close makes __tun_detach call unregister_netdevice and delete the interface."}]}],"providerMetadata":{"dateUpdated":"2026-11-10T18:15:28.611Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/e0d98aab41b79b88609f33fb4d8e7a80ab8f648d"},{"url":"https://git.kernel.org/stable/c/2f92c0286cfd58bff9d6d54c01a771073d5eb775"},{"url":"https://git.kernel.org/stable/c/e53d1cf05da8ea58a5743b7ce5894fb51b0b9700"},{"url":"https://git.kernel.org/stable/c/ffdf678dd16610e3f006dac904bd37c09684673c"}],"title":"tun: Require CAP_NET_ADMIN to attach to an ownerless device","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-99281","datePublished":"2026-11-07T14:08:47.735Z","dateReserved":"2026-09-25T10:25:14.405Z","dateUpdated":"2026-11-10T18:15:28.611Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794500401,"cve":"CVE-2026-99281","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntun: Require CAP_NET_ADMIN to attach to an ownerless device\n\nTwenty years ago I made creating a tuntap device require CAP_NET_ADMIN\nin commit ca6bb5d7ab22 (\"[NET]: Require CAP_NET_ADMIN to create tuntap\ndevices.\")\n\nThe idea was to allow the permissions on /dev/net/tun to be relaxed to\n0666 and thus allow owners of tun devices assigned with TUNSETOWNER to\nactually open it and get at their devices.\n\nWhat we missed at the time was that persistent devices with *no* owner\nwere already essentially world-consumable, and anyone who could open\nthe device node could also attach to those.\n\nEven then, using persistent devices with no explicitly set owner — on\nthe (false) presumption that CAP_NET_ADMIN would be required to open\nthem — wasn't an egregious userspace bug. There are cases where it does\nmake sense to separate the creation/configuration of the netdevice, from\nthe process which shovels packets into it.\n\nSince then, TUNSETGROUP was added a year later in commit 8c644623fe7e\n(\"[NET]: Allow group ownership of TUN/TAP devices.\"). Its commit message\nnoted that if both uid and gid are set, both have to match (in itself a\nbizarre choice) — but still not that with *neither* set, no permission\nat all was required.\n\nThen in 2012 commit c8d68e6be1c3 (\"tuntap: multiqueue support\") allowed\nnew queues to be attached to a device from the moment of its creation,\nwith no way for userspace to close the race between creation and a\nsubsequent TUNSET{OWNER,GROUP}.\n\nIn 2024, commit 3ca459eaba1bf (\"tun: fix group permission check\") tried\nto fix things to be saner: only require the user *or* the group to\nmatch, in line with standard POSIX permissions, and require\nCAP_NET_ADMIN if neither the user nor group authorised the access\n(although it put the CAP_NET_ADMIN check first, and would wrongly have\nreported the capability as having been used even when it was not).\n\nThat fix was reverted in commit a70c7b3cbc06 (\"tun: revert fix group\npermission check\") due to allegedly causing a regression in an selinux\ntest suite which *expected* the attachment to succeed when authorised\nby none of user, group, nor CAP_NET_ADMIN:\nhttps://lore.kernel.org/netdev/CAFqZXNtkCBT4f+PwyVRmQGoT3p1eVa01fCG_aNtpt6dakXncUg@mail.gmail.com/\n\nWe should not break UAPI. But we don't have to consider an selinux test\ncase which deliberately exercises a security flaw to be UAPI worth\npreserving either. To which end, I have fixed it in selinux-testsuite\ncommit b2f894f0016b (\"tests/tun_tap: set an owner on the device for the\nrelabel tests\").\n\nSo: fix the lack of CAP_NET_ADMIN check on devices which *haven't* been\nassigned an owner or group, while leaving the weird tun ownership model\nas it was (user *and* group have to match, if both are set). If someone\nstill wants to fix the latter (which wasn't actually the reason the\nprevious attempt was reverted), they can do it under separate cover.\n\nPermit attaching to an existing device only if an owner and/or group was\nset and the caller matches all that were set, or if the caller has\nCAP_NET_ADMIN. The only behavioural change is that a device with no\nowner or group now requires CAP_NET_ADMIN to attach — precisely the\nloophole we want to close.\n\nAnd put the CAP_NET_ADMIN check in the right place this time.","epss":{"date":"2026-11-12","epss":0.0012,"percentile":0.01853},"epss_checked":1794522003,"first_seen":1794378631,"kev":null,"kev_checked":1794522003,"products":"Linux Linux","references":["https://git.kernel.org/stable/c/e0d98aab41b79b88609f33fb4d8e7a80ab8f648d","https://git.kernel.org/stable/c/2f92c0286cfd58bff9d6d54c01a771073d5eb775","https://git.kernel.org/stable/c/e53d1cf05da8ea58a5743b7ce5894fb51b0b9700","https://git.kernel.org/stable/c/ffdf678dd16610e3f006dac904bd37c09684673c"],"score":{"baseScore":7.8,"baseSeverity":"HIGH","provider":"Linux","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"solutions":"","state":"PUBLISHED","title":"tun: Require CAP_NET_ADMIN to attach to an ownerless device","updated_at":1794500401,"url":"https://www.clawpit.io/egret/cves/CVE-2026-99281","workarounds":""},{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/linux/key-type.h","include/linux/key.h","security/keys/keyring.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"9ebe824d55983c9f063a2c9ef1a08b29812d406f","status":"affected","version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","versionType":"git"},{"lessThan":"e108b22999edbc6f431466baf6b2016c19b7ed31","status":"affected","version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","versionType":"git"},{"lessThan":"9f084ef0beb68091e96ab96f0e95579aac8a77f9","status":"affected","version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","versionType":"git"},{"lessThan":"8451d4a4c43127c3b9fdf9fc9ff3fea5539a61f9","status":"affected","version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","versionType":"git"},{"lessThan":"13fc051269d670810d9e314061b61c6dd06116a0","status":"affected","version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","versionType":"git"},{"lessThan":"61ac0585d9f4344d3dfb84b5edff1fee7d532897","status":"affected","version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","versionType":"git"},{"lessThan":"84f7c699f8d139f743c7dc11ef41d085690955bb","status":"affected","version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","versionType":"git"},{"lessThan":"a113eba06bd1183c614d7994864d6e7054140cb9","status":"affected","version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","versionType":"git"},{"lessThan":"de891c73c1cf41ac8de12c07fa2c84d6a912ad0c","status":"affected","version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["include/linux/key-type.h","include/linux/key.h","security/keys/keyring.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.13"},{"lessThan":"3.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.273","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.224","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.161","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.115","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.60","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.14","versionType":"semver"},{"lessThanOrEqual":"7.3.*","status":"unaffected","version":"7.3.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.4-rc1","versionType":"original_commit_for_fix"}]}],"cna":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/linux/key-type.h","include/linux/key.h","security/keys/keyring.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"9ebe824d55983c9f063a2c9ef1a08b29812d406f","status":"affected","version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","versionType":"git"},{"lessThan":"e108b22999edbc6f431466baf6b2016c19b7ed31","status":"affected","version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","versionType":"git"},{"lessThan":"9f084ef0beb68091e96ab96f0e95579aac8a77f9","status":"affected","version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","versionType":"git"},{"lessThan":"8451d4a4c43127c3b9fdf9fc9ff3fea5539a61f9","status":"affected","version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","versionType":"git"},{"lessThan":"13fc051269d670810d9e314061b61c6dd06116a0","status":"affected","version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","versionType":"git"},{"lessThan":"61ac0585d9f4344d3dfb84b5edff1fee7d532897","status":"affected","version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","versionType":"git"},{"lessThan":"84f7c699f8d139f743c7dc11ef41d085690955bb","status":"affected","version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","versionType":"git"},{"lessThan":"a113eba06bd1183c614d7994864d6e7054140cb9","status":"affected","version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","versionType":"git"},{"lessThan":"de891c73c1cf41ac8de12c07fa2c84d6a912ad0c","status":"affected","version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["include/linux/key-type.h","include/linux/key.h","security/keys/keyring.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.13"},{"lessThan":"3.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.273","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.224","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.161","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.115","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.60","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.14","versionType":"semver"},{"lessThanOrEqual":"7.3.*","status":"unaffected","version":"7.3.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.4-rc1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.273","versionStartIncluding":"3.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.224","versionStartIncluding":"3.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.191","versionStartIncluding":"3.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.161","versionStartIncluding":"3.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.115","versionStartIncluding":"3.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.60","versionStartIncluding":"3.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.14","versionStartIncluding":"3.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3.1","versionStartIncluding":"3.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.4-rc1","versionStartIncluding":"3.13","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nkeys: make keyring indexes independent of kernel addresses\n\nKEYCTL_READ returns the serial numbers in a keyring in associative-array\ntraversal order.  The first word of the index is a public, deterministic\nhash of the type pointer, domain pointer and description.  An unprivileged\nuser can therefore insert keys with known descriptions, predict their\norder for each possible KASLR slide, and recover the kernel image address.\nOn an x86-64 build with 16 MiB alignment, 45 user keys suffice to\ndistinguish the candidate slides.\n\nRemove the addresses from the whole index, not just its first hash word.\nAssign each key type and domain a nonzero 64-bit ID and hash those IDs and\nthe description with a once-initialized SipHash key.  Use the full IDs in\nthe later index chunks as well.  Truncating or hashing the IDs there would\nlose the guarantee that distinct type/domain/description tuples have a\ndiffering index bit.\n\nAllocate IDs lazily since private key types need not be registered.  Cache\nthem in the index key so tree walks and copies of an existing index do not\nneed to dereference a type descriptor that may have been unregistered.\nKeep the 32-bit chunk layout and diff_objects() bit offsets consistent,\nand retain the separate root slot for keyrings used by recursive search.\nThe key comparison, permissions and userspace data format are unchanged;\nonly the address-dependent in-memory ordering is replaced."}],"providerMetadata":{"dateUpdated":"2026-11-03T19:12:57.119Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/9ebe824d55983c9f063a2c9ef1a08b29812d406f"},{"url":"https://git.kernel.org/stable/c/e108b22999edbc6f431466baf6b2016c19b7ed31"},{"url":"https://git.kernel.org/stable/c/9f084ef0beb68091e96ab96f0e95579aac8a77f9"},{"url":"https://git.kernel.org/stable/c/8451d4a4c43127c3b9fdf9fc9ff3fea5539a61f9"},{"url":"https://git.kernel.org/stable/c/13fc051269d670810d9e314061b61c6dd06116a0"},{"url":"https://git.kernel.org/stable/c/61ac0585d9f4344d3dfb84b5edff1fee7d532897"},{"url":"https://git.kernel.org/stable/c/84f7c699f8d139f743c7dc11ef41d085690955bb"},{"url":"https://git.kernel.org/stable/c/a113eba06bd1183c614d7994864d6e7054140cb9"},{"url":"https://git.kernel.org/stable/c/de891c73c1cf41ac8de12c07fa2c84d6a912ad0c"}],"title":"keys: make keyring indexes independent of kernel addresses","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-99223","datePublished":"2026-11-02T16:06:33.408Z","dateReserved":"2026-09-25T10:25:14.402Z","dateUpdated":"2026-11-03T19:12:57.119Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794500401,"cve":"CVE-2026-99223","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nkeys: make keyring indexes independent of kernel addresses\n\nKEYCTL_READ returns the serial numbers in a keyring in associative-array\ntraversal order.  The first word of the index is a public, deterministic\nhash of the type pointer, domain pointer and description.  An unprivileged\nuser can therefore insert keys with known descriptions, predict their\norder for each possible KASLR slide, and recover the kernel image address.\nOn an x86-64 build with 16 MiB alignment, 45 user keys suffice to\ndistinguish the candidate slides.\n\nRemove the addresses from the whole index, not just its first hash word.\nAssign each key type and domain a nonzero 64-bit ID and hash those IDs and\nthe description with a once-initialized SipHash key.  Use the full IDs in\nthe later index chunks as well.  Truncating or hashing the IDs there would\nlose the guarantee that distinct type/domain/description tuples have a\ndiffering index bit.\n\nAllocate IDs lazily since private key types need not be registered.  Cache\nthem in the index key so tree walks and copies of an existing index do not\nneed to dereference a type descriptor that may have been unregistered.\nKeep the 32-bit chunk layout and diff_objects() bit offsets consistent,\nand retain the separate root slot for keyrings used by recursive search.\nThe key comparison, permissions and userspace data format are unchanged;\nonly the address-dependent in-memory ordering is replaced.","epss":{"date":"2026-11-12","epss":0.00182,"percentile":0.07894},"epss_checked":1794522003,"first_seen":1794378631,"kev":null,"kev_checked":1794522003,"products":"Linux Linux","references":["https://git.kernel.org/stable/c/9ebe824d55983c9f063a2c9ef1a08b29812d406f","https://git.kernel.org/stable/c/e108b22999edbc6f431466baf6b2016c19b7ed31","https://git.kernel.org/stable/c/9f084ef0beb68091e96ab96f0e95579aac8a77f9","https://git.kernel.org/stable/c/8451d4a4c43127c3b9fdf9fc9ff3fea5539a61f9","https://git.kernel.org/stable/c/13fc051269d670810d9e314061b61c6dd06116a0","https://git.kernel.org/stable/c/61ac0585d9f4344d3dfb84b5edff1fee7d532897","https://git.kernel.org/stable/c/84f7c699f8d139f743c7dc11ef41d085690955bb","https://git.kernel.org/stable/c/a113eba06bd1183c614d7994864d6e7054140cb9","https://git.kernel.org/stable/c/de891c73c1cf41ac8de12c07fa2c84d6a912ad0c"],"score":null,"solutions":"","state":"PUBLISHED","title":"keys: make keyring indexes independent of kernel addresses","updated_at":1794500401,"url":"https://www.clawpit.io/egret/cves/CVE-2026-99223","workarounds":""},{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["security/keys/keyctl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e5f830ae6611cddbfc504c43f14155f60b63206a","status":"affected","version":"d3ec10aa95819bff18a0d936b18884c7816d0914","versionType":"git"},{"lessThan":"ff11cfed85cbfdd7fe1185ebd18d2c7a8353ad8d","status":"affected","version":"d3ec10aa95819bff18a0d936b18884c7816d0914","versionType":"git"},{"lessThan":"1486caee47b4909f52835a957c3293e970113e44","status":"affected","version":"d3ec10aa95819bff18a0d936b18884c7816d0914","versionType":"git"},{"lessThan":"ff44f1b303aa76a818d898e85c56ed4852c031e2","status":"affected","version":"d3ec10aa95819bff18a0d936b18884c7816d0914","versionType":"git"},{"lessThan":"6a36e2a1a017c51f8a8ad2a094566bad97c46a9b","status":"affected","version":"d3ec10aa95819bff18a0d936b18884c7816d0914","versionType":"git"},{"lessThan":"3edc064069d07e7d37359fcb4d03d3bab15ee3ab","status":"affected","version":"d3ec10aa95819bff18a0d936b18884c7816d0914","versionType":"git"},{"lessThan":"cf1af7df80e38bf58bd74c2cccce32fcbd1a596a","status":"affected","version":"d3ec10aa95819bff18a0d936b18884c7816d0914","versionType":"git"},{"lessThan":"e2a2deda08d91644f5e30c17d267b1cdc5f124b2","status":"affected","version":"d3ec10aa95819bff18a0d936b18884c7816d0914","versionType":"git"},{"lessThan":"925c84e3cc21caf09de92d9bcafab0147790debf","status":"affected","version":"d3ec10aa95819bff18a0d936b18884c7816d0914","versionType":"git"},{"status":"affected","version":"7fa67aa30509ad0da72ac0f757aa76e53c0ea3de","versionType":"git"},{"status":"affected","version":"18779eac17b5df9dff57138d07631573553a41d4","versionType":"git"},{"status":"affected","version":"f1afcf9488fc45765e20e2047d3b776981900e0b","versionType":"git"},{"status":"affected","version":"212d3adb1af4e34acb158d6c6def370016a1011d","versionType":"git"},{"lessThan":"4.15","status":"affected","version":"4.14.177","versionType":"semver"},{"lessThan":"4.20","status":"affected","version":"4.19.118","versionType":"semver"},{"lessThan":"5.5","status":"affected","version":"5.4.35","versionType":"semver"},{"lessThan":"5.7","status":"affected","version":"5.6.7","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["security/keys/keyctl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.7"},{"lessThan":"5.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.273","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.224","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.161","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.115","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.60","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.14","versionType":"semver"},{"lessThanOrEqual":"7.3.*","status":"unaffected","version":"7.3.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.4-rc1","versionType":"original_commit_for_fix"}]}],"cna":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["security/keys/keyctl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e5f830ae6611cddbfc504c43f14155f60b63206a","status":"affected","version":"d3ec10aa95819bff18a0d936b18884c7816d0914","versionType":"git"},{"lessThan":"ff11cfed85cbfdd7fe1185ebd18d2c7a8353ad8d","status":"affected","version":"d3ec10aa95819bff18a0d936b18884c7816d0914","versionType":"git"},{"lessThan":"1486caee47b4909f52835a957c3293e970113e44","status":"affected","version":"d3ec10aa95819bff18a0d936b18884c7816d0914","versionType":"git"},{"lessThan":"ff44f1b303aa76a818d898e85c56ed4852c031e2","status":"affected","version":"d3ec10aa95819bff18a0d936b18884c7816d0914","versionType":"git"},{"lessThan":"6a36e2a1a017c51f8a8ad2a094566bad97c46a9b","status":"affected","version":"d3ec10aa95819bff18a0d936b18884c7816d0914","versionType":"git"},{"lessThan":"3edc064069d07e7d37359fcb4d03d3bab15ee3ab","status":"affected","version":"d3ec10aa95819bff18a0d936b18884c7816d0914","versionType":"git"},{"lessThan":"cf1af7df80e38bf58bd74c2cccce32fcbd1a596a","status":"affected","version":"d3ec10aa95819bff18a0d936b18884c7816d0914","versionType":"git"},{"lessThan":"e2a2deda08d91644f5e30c17d267b1cdc5f124b2","status":"affected","version":"d3ec10aa95819bff18a0d936b18884c7816d0914","versionType":"git"},{"lessThan":"925c84e3cc21caf09de92d9bcafab0147790debf","status":"affected","version":"d3ec10aa95819bff18a0d936b18884c7816d0914","versionType":"git"},{"status":"affected","version":"7fa67aa30509ad0da72ac0f757aa76e53c0ea3de","versionType":"git"},{"status":"affected","version":"18779eac17b5df9dff57138d07631573553a41d4","versionType":"git"},{"status":"affected","version":"f1afcf9488fc45765e20e2047d3b776981900e0b","versionType":"git"},{"status":"affected","version":"212d3adb1af4e34acb158d6c6def370016a1011d","versionType":"git"},{"lessThan":"4.15","status":"affected","version":"4.14.177","versionType":"semver"},{"lessThan":"4.20","status":"affected","version":"4.19.118","versionType":"semver"},{"lessThan":"5.5","status":"affected","version":"5.4.35","versionType":"semver"},{"lessThan":"5.7","status":"affected","version":"5.6.7","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["security/keys/keyctl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.7"},{"lessThan":"5.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.273","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.224","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.161","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.115","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.60","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.14","versionType":"semver"},{"lessThanOrEqual":"7.3.*","status":"unaffected","version":"7.3.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.4-rc1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.273","versionStartIncluding":"5.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.224","versionStartIncluding":"5.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.191","versionStartIncluding":"5.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.161","versionStartIncluding":"5.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.115","versionStartIncluding":"5.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.60","versionStartIncluding":"5.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.14","versionStartIncluding":"5.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3.1","versionStartIncluding":"5.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.4-rc1","versionStartIncluding":"5.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14.177","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19.118","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4.35","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6.7","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nkeys: Protect the read method check against type removal\n\nkeyctl_read_key() checks key->type->read without holding key->sem.\nA reference keeps the key alive, but does not pin the module containing\nits type. A surviving RxRPC key can therefore be read while AF_RXRPC\nis being unloaded:\n\n  KEYCTL_READ task                    Module unload and key GC\n  ----------------                   ------------------------\n  lookup_user_key()\n  permission / possession checks\n  load key->type\n                                     af_rxrpc_exit()\n                                       unregister_key_type()\n                                         GC: down_write(key->sem)\n                                         GC: retype to key_type_dead\n                                         GC: up_write(key->sem)\n                                       unregister_key_type() returns\n                                     free_module()\n  read saved type's read member\n\nThe final access can read freed module storage. The read invocation in\n__keyctl_read_key() is already protected by key->sem, but the earlier\nmethod check is outside that critical section.\n\nMove the method check into __keyctl_read_key(), after key_validate() and\nunder its existing read hold on key->sem. The check and invocation then\nuse the same protected type for length queries and every read retry.\nThe GC cannot retype the key until the semaphore is released, and type\nunregistration waits for that GC pass before the module can be freed.\n\nReturn -EOPNOTSUPP when validation succeeds and the type has no read\nmethod. A temporary buffer may now be allocated before this result;\nallocation and copying to userspace remain outside the semaphore."}],"providerMetadata":{"dateUpdated":"2026-11-03T19:12:56.503Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/e5f830ae6611cddbfc504c43f14155f60b63206a"},{"url":"https://git.kernel.org/stable/c/ff11cfed85cbfdd7fe1185ebd18d2c7a8353ad8d"},{"url":"https://git.kernel.org/stable/c/1486caee47b4909f52835a957c3293e970113e44"},{"url":"https://git.kernel.org/stable/c/ff44f1b303aa76a818d898e85c56ed4852c031e2"},{"url":"https://git.kernel.org/stable/c/6a36e2a1a017c51f8a8ad2a094566bad97c46a9b"},{"url":"https://git.kernel.org/stable/c/3edc064069d07e7d37359fcb4d03d3bab15ee3ab"},{"url":"https://git.kernel.org/stable/c/cf1af7df80e38bf58bd74c2cccce32fcbd1a596a"},{"url":"https://git.kernel.org/stable/c/e2a2deda08d91644f5e30c17d267b1cdc5f124b2"},{"url":"https://git.kernel.org/stable/c/925c84e3cc21caf09de92d9bcafab0147790debf"}],"title":"keys: Protect the read method check against type removal","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-99222","datePublished":"2026-11-02T16:06:32.844Z","dateReserved":"2026-09-25T10:25:14.402Z","dateUpdated":"2026-11-03T19:12:56.503Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794500401,"cve":"CVE-2026-99222","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nkeys: Protect the read method check against type removal\n\nkeyctl_read_key() checks key->type->read without holding key->sem.\nA reference keeps the key alive, but does not pin the module containing\nits type. A surviving RxRPC key can therefore be read while AF_RXRPC\nis being unloaded:\n\n  KEYCTL_READ task                    Module unload and key GC\n  ----------------                   ------------------------\n  lookup_user_key()\n  permission / possession checks\n  load key->type\n                                     af_rxrpc_exit()\n                                       unregister_key_type()\n                                         GC: down_write(key->sem)\n                                         GC: retype to key_type_dead\n                                         GC: up_write(key->sem)\n                                       unregister_key_type() returns\n                                     free_module()\n  read saved type's read member\n\nThe final access can read freed module storage. The read invocation in\n__keyctl_read_key() is already protected by key->sem, but the earlier\nmethod check is outside that critical section.\n\nMove the method check into __keyctl_read_key(), after key_validate() and\nunder its existing read hold on key->sem. The check and invocation then\nuse the same protected type for length queries and every read retry.\nThe GC cannot retype the key until the semaphore is released, and type\nunregistration waits for that GC pass before the module can be freed.\n\nReturn -EOPNOTSUPP when validation succeeds and the type has no read\nmethod. A temporary buffer may now be allocated before this result;\nallocation and copying to userspace remain outside the semaphore.","epss":{"date":"2026-11-12","epss":0.00182,"percentile":0.07894},"epss_checked":1794522003,"first_seen":1794378631,"kev":null,"kev_checked":1794522003,"products":"Linux Linux","references":["https://git.kernel.org/stable/c/e5f830ae6611cddbfc504c43f14155f60b63206a","https://git.kernel.org/stable/c/ff11cfed85cbfdd7fe1185ebd18d2c7a8353ad8d","https://git.kernel.org/stable/c/1486caee47b4909f52835a957c3293e970113e44","https://git.kernel.org/stable/c/ff44f1b303aa76a818d898e85c56ed4852c031e2","https://git.kernel.org/stable/c/6a36e2a1a017c51f8a8ad2a094566bad97c46a9b","https://git.kernel.org/stable/c/3edc064069d07e7d37359fcb4d03d3bab15ee3ab","https://git.kernel.org/stable/c/cf1af7df80e38bf58bd74c2cccce32fcbd1a596a","https://git.kernel.org/stable/c/e2a2deda08d91644f5e30c17d267b1cdc5f124b2","https://git.kernel.org/stable/c/925c84e3cc21caf09de92d9bcafab0147790debf"],"score":null,"solutions":"","state":"PUBLISHED","title":"keys: Protect the read method check against type removal","updated_at":1794500401,"url":"https://www.clawpit.io/egret/cves/CVE-2026-99222","workarounds":""},{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["security/keys/trusted-keys/trusted_tpm1.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4876f09ce222e140a73aad950882b3605440c935","status":"affected","version":"5d0682be318910e028bdf57c90a1695ffc34be37","versionType":"git"},{"lessThan":"2d92a0f87c338a08367aff05edd1ade86da4ac8d","status":"affected","version":"5d0682be318910e028bdf57c90a1695ffc34be37","versionType":"git"},{"lessThan":"234d09bb3b3d84851d4b3246272addc30f3353eb","status":"affected","version":"5d0682be318910e028bdf57c90a1695ffc34be37","versionType":"git"},{"lessThan":"6e359d8cb8580b9874801dea930086effd4d9c62","status":"affected","version":"5d0682be318910e028bdf57c90a1695ffc34be37","versionType":"git"},{"lessThan":"e55d48f21f591a9fe80d26b5fbd1912ea725d9e6","status":"affected","version":"5d0682be318910e028bdf57c90a1695ffc34be37","versionType":"git"},{"lessThan":"63b19ec2863b2cb5279b746ecd3d6210b1a93945","status":"affected","version":"5d0682be318910e028bdf57c90a1695ffc34be37","versionType":"git"},{"lessThan":"ed697a5f667435bbb1cedbe5bd9f300de645047d","status":"affected","version":"5d0682be318910e028bdf57c90a1695ffc34be37","versionType":"git"},{"lessThan":"f92d0ccb05bf9089072cb067dda0dffd5394c4ef","status":"affected","version":"5d0682be318910e028bdf57c90a1695ffc34be37","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["security/keys/trusted-keys/trusted_tpm1.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.13"},{"lessThan":"5.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.224","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.161","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.115","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.60","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.14","versionType":"semver"},{"lessThanOrEqual":"7.3.*","status":"unaffected","version":"7.3.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.4-rc1","versionType":"original_commit_for_fix"}]}],"cna":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["security/keys/trusted-keys/trusted_tpm1.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4876f09ce222e140a73aad950882b3605440c935","status":"affected","version":"5d0682be318910e028bdf57c90a1695ffc34be37","versionType":"git"},{"lessThan":"2d92a0f87c338a08367aff05edd1ade86da4ac8d","status":"affected","version":"5d0682be318910e028bdf57c90a1695ffc34be37","versionType":"git"},{"lessThan":"234d09bb3b3d84851d4b3246272addc30f3353eb","status":"affected","version":"5d0682be318910e028bdf57c90a1695ffc34be37","versionType":"git"},{"lessThan":"6e359d8cb8580b9874801dea930086effd4d9c62","status":"affected","version":"5d0682be318910e028bdf57c90a1695ffc34be37","versionType":"git"},{"lessThan":"e55d48f21f591a9fe80d26b5fbd1912ea725d9e6","status":"affected","version":"5d0682be318910e028bdf57c90a1695ffc34be37","versionType":"git"},{"lessThan":"63b19ec2863b2cb5279b746ecd3d6210b1a93945","status":"affected","version":"5d0682be318910e028bdf57c90a1695ffc34be37","versionType":"git"},{"lessThan":"ed697a5f667435bbb1cedbe5bd9f300de645047d","status":"affected","version":"5d0682be318910e028bdf57c90a1695ffc34be37","versionType":"git"},{"lessThan":"f92d0ccb05bf9089072cb067dda0dffd5394c4ef","status":"affected","version":"5d0682be318910e028bdf57c90a1695ffc34be37","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["security/keys/trusted-keys/trusted_tpm1.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.13"},{"lessThan":"5.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.224","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.161","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.115","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.60","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.14","versionType":"semver"},{"lessThanOrEqual":"7.3.*","status":"unaffected","version":"7.3.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.4-rc1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.224","versionStartIncluding":"5.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.191","versionStartIncluding":"5.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.161","versionStartIncluding":"5.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.115","versionStartIncluding":"5.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.60","versionStartIncluding":"5.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.14","versionStartIncluding":"5.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3.1","versionStartIncluding":"5.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.4-rc1","versionStartIncluding":"5.13","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nkeys/trusted_keys: return immediately after TPM unseal failure\n\ntrusted_tpm_unseal() proceeds to pcrlock() when the TPM unseal operation\nfails. If pcrlock() succeeds, its return value overwrites the unseal error,\ncausing key instantiation to succeed.\n\nReturn immediately when unseal fails to preserve the original error."}],"providerMetadata":{"dateUpdated":"2026-11-03T19:12:55.574Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/4876f09ce222e140a73aad950882b3605440c935"},{"url":"https://git.kernel.org/stable/c/2d92a0f87c338a08367aff05edd1ade86da4ac8d"},{"url":"https://git.kernel.org/stable/c/234d09bb3b3d84851d4b3246272addc30f3353eb"},{"url":"https://git.kernel.org/stable/c/6e359d8cb8580b9874801dea930086effd4d9c62"},{"url":"https://git.kernel.org/stable/c/e55d48f21f591a9fe80d26b5fbd1912ea725d9e6"},{"url":"https://git.kernel.org/stable/c/63b19ec2863b2cb5279b746ecd3d6210b1a93945"},{"url":"https://git.kernel.org/stable/c/ed697a5f667435bbb1cedbe5bd9f300de645047d"},{"url":"https://git.kernel.org/stable/c/f92d0ccb05bf9089072cb067dda0dffd5394c4ef"}],"title":"keys/trusted_keys: return immediately after TPM unseal failure","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-99221","datePublished":"2026-11-02T16:06:32.409Z","dateReserved":"2026-09-25T10:25:14.401Z","dateUpdated":"2026-11-03T19:12:55.574Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794500401,"cve":"CVE-2026-99221","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nkeys/trusted_keys: return immediately after TPM unseal failure\n\ntrusted_tpm_unseal() proceeds to pcrlock() when the TPM unseal operation\nfails. If pcrlock() succeeds, its return value overwrites the unseal error,\ncausing key instantiation to succeed.\n\nReturn immediately when unseal fails to preserve the original error.","epss":{"date":"2026-11-12","epss":0.00177,"percentile":0.07344},"epss_checked":1794522003,"first_seen":1794378631,"kev":null,"kev_checked":1794522003,"products":"Linux Linux","references":["https://git.kernel.org/stable/c/4876f09ce222e140a73aad950882b3605440c935","https://git.kernel.org/stable/c/2d92a0f87c338a08367aff05edd1ade86da4ac8d","https://git.kernel.org/stable/c/234d09bb3b3d84851d4b3246272addc30f3353eb","https://git.kernel.org/stable/c/6e359d8cb8580b9874801dea930086effd4d9c62","https://git.kernel.org/stable/c/e55d48f21f591a9fe80d26b5fbd1912ea725d9e6","https://git.kernel.org/stable/c/63b19ec2863b2cb5279b746ecd3d6210b1a93945","https://git.kernel.org/stable/c/ed697a5f667435bbb1cedbe5bd9f300de645047d","https://git.kernel.org/stable/c/f92d0ccb05bf9089072cb067dda0dffd5394c4ef"],"score":null,"solutions":"","state":"PUBLISHED","title":"keys/trusted_keys: return immediately after TPM unseal failure","updated_at":1794500401,"url":"https://www.clawpit.io/egret/cves/CVE-2026-99221","workarounds":""},{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["crypto/asymmetric_keys/restrict.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"889a2293a95f6c2880bf73b67f9b0af23251a128","status":"affected","version":"3c58b2362ba828ee2970c66c6a6fd7b04fde4413","versionType":"git"},{"lessThan":"7f0728ba89624e25df2bb80ff59bbfb545060935","status":"affected","version":"3c58b2362ba828ee2970c66c6a6fd7b04fde4413","versionType":"git"},{"lessThan":"2a40bdd4409567de4c2a141ac66439dc238af752","status":"affected","version":"3c58b2362ba828ee2970c66c6a6fd7b04fde4413","versionType":"git"},{"lessThan":"1aa0c7aa4c2554a5b6d74ae1924508ca4718234b","status":"affected","version":"3c58b2362ba828ee2970c66c6a6fd7b04fde4413","versionType":"git"},{"lessThan":"33a078f04e264eb71aa9f209cb334e4010123818","status":"affected","version":"3c58b2362ba828ee2970c66c6a6fd7b04fde4413","versionType":"git"},{"lessThan":"57e54b6939c6539d90a81c7e57531901d5991651","status":"affected","version":"3c58b2362ba828ee2970c66c6a6fd7b04fde4413","versionType":"git"},{"lessThan":"9695df3b1db4ac4534274d38ee16e3b9b0bf910e","status":"affected","version":"3c58b2362ba828ee2970c66c6a6fd7b04fde4413","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["crypto/asymmetric_keys/restrict.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.20"},{"lessThan":"4.20","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.161","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.115","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.60","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.14","versionType":"semver"},{"lessThanOrEqual":"7.3.*","status":"unaffected","version":"7.3.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.4-rc1","versionType":"original_commit_for_fix"}]}],"cna":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["crypto/asymmetric_keys/restrict.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"889a2293a95f6c2880bf73b67f9b0af23251a128","status":"affected","version":"3c58b2362ba828ee2970c66c6a6fd7b04fde4413","versionType":"git"},{"lessThan":"7f0728ba89624e25df2bb80ff59bbfb545060935","status":"affected","version":"3c58b2362ba828ee2970c66c6a6fd7b04fde4413","versionType":"git"},{"lessThan":"2a40bdd4409567de4c2a141ac66439dc238af752","status":"affected","version":"3c58b2362ba828ee2970c66c6a6fd7b04fde4413","versionType":"git"},{"lessThan":"1aa0c7aa4c2554a5b6d74ae1924508ca4718234b","status":"affected","version":"3c58b2362ba828ee2970c66c6a6fd7b04fde4413","versionType":"git"},{"lessThan":"33a078f04e264eb71aa9f209cb334e4010123818","status":"affected","version":"3c58b2362ba828ee2970c66c6a6fd7b04fde4413","versionType":"git"},{"lessThan":"57e54b6939c6539d90a81c7e57531901d5991651","status":"affected","version":"3c58b2362ba828ee2970c66c6a6fd7b04fde4413","versionType":"git"},{"lessThan":"9695df3b1db4ac4534274d38ee16e3b9b0bf910e","status":"affected","version":"3c58b2362ba828ee2970c66c6a6fd7b04fde4413","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["crypto/asymmetric_keys/restrict.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.20"},{"lessThan":"4.20","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.161","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.115","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.60","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.14","versionType":"semver"},{"lessThanOrEqual":"7.3.*","status":"unaffected","version":"7.3.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.4-rc1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.191","versionStartIncluding":"4.20","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.161","versionStartIncluding":"4.20","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.115","versionStartIncluding":"4.20","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.60","versionStartIncluding":"4.20","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.14","versionStartIncluding":"4.20","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3.1","versionStartIncluding":"4.20","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.4-rc1","versionStartIncluding":"4.20","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nasymmetric_keys: reject trust keys without IDs\n\nThe PKCS#8 parser deliberately leaves the asym_key_ids payload slot\nempty. key_or_keyring_common() unconditionally dereferences that slot\nwhen a PKCS#8 key is supplied to a key_or_keyring restriction. Both the\nplain and :chain forms reach this branch, allowing an unprivileged caller\nto trigger a NULL pointer dereference through KEYCTL_RESTRICT_KEYRING\nfollowed by add_key().\n\n Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n RIP: 0010:key_or_keyring_common (crypto/asymmetric_keys/restrict.c:205 crypto/asymmetric_keys/restrict.c:279)\n Call Trace:\n  <TASK>\n  __key_create_or_update (security/keys/key.c:884)\n  key_create_or_update (security/keys/key.c:1021)\n  __do_sys_add_key (security/keys/keyctl.c:134)\n  do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)\n  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n  </TASK>\n Kernel panic - not syncing: Fatal exception\n\nReject an asymmetric restriction key without key IDs. A PKCS#8 private\nkey cannot identify the signer of a candidate certificate and is not a\nvalid trust anchor."}],"providerMetadata":{"dateUpdated":"2026-11-03T19:12:54.971Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/889a2293a95f6c2880bf73b67f9b0af23251a128"},{"url":"https://git.kernel.org/stable/c/7f0728ba89624e25df2bb80ff59bbfb545060935"},{"url":"https://git.kernel.org/stable/c/2a40bdd4409567de4c2a141ac66439dc238af752"},{"url":"https://git.kernel.org/stable/c/1aa0c7aa4c2554a5b6d74ae1924508ca4718234b"},{"url":"https://git.kernel.org/stable/c/33a078f04e264eb71aa9f209cb334e4010123818"},{"url":"https://git.kernel.org/stable/c/57e54b6939c6539d90a81c7e57531901d5991651"},{"url":"https://git.kernel.org/stable/c/9695df3b1db4ac4534274d38ee16e3b9b0bf910e"}],"title":"asymmetric_keys: reject trust keys without IDs","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-99220","datePublished":"2026-11-02T16:06:31.966Z","dateReserved":"2026-09-25T10:25:14.401Z","dateUpdated":"2026-11-03T19:12:54.971Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794500401,"cve":"CVE-2026-99220","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nasymmetric_keys: reject trust keys without IDs\n\nThe PKCS#8 parser deliberately leaves the asym_key_ids payload slot\nempty. key_or_keyring_common() unconditionally dereferences that slot\nwhen a PKCS#8 key is supplied to a key_or_keyring restriction. Both the\nplain and :chain forms reach this branch, allowing an unprivileged caller\nto trigger a NULL pointer dereference through KEYCTL_RESTRICT_KEYRING\nfollowed by add_key().\n\n Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n RIP: 0010:key_or_keyring_common (crypto/asymmetric_keys/restrict.c:205 crypto/asymmetric_keys/restrict.c:279)\n Call Trace:\n  <TASK>\n  __key_create_or_update (security/keys/key.c:884)\n  key_create_or_update (security/keys/key.c:1021)\n  __do_sys_add_key (security/keys/keyctl.c:134)\n  do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)\n  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n  </TASK>\n Kernel panic - not syncing: Fatal exception\n\nReject an asymmetric restriction key without key IDs. A PKCS#8 private\nkey cannot identify the signer of a candidate certificate and is not a\nvalid trust anchor.","epss":{"date":"2026-11-12","epss":0.00122,"percentile":0.01972},"epss_checked":1794522003,"first_seen":1794378631,"kev":null,"kev_checked":1794522003,"products":"Linux Linux","references":["https://git.kernel.org/stable/c/889a2293a95f6c2880bf73b67f9b0af23251a128","https://git.kernel.org/stable/c/7f0728ba89624e25df2bb80ff59bbfb545060935","https://git.kernel.org/stable/c/2a40bdd4409567de4c2a141ac66439dc238af752","https://git.kernel.org/stable/c/1aa0c7aa4c2554a5b6d74ae1924508ca4718234b","https://git.kernel.org/stable/c/33a078f04e264eb71aa9f209cb334e4010123818","https://git.kernel.org/stable/c/57e54b6939c6539d90a81c7e57531901d5991651","https://git.kernel.org/stable/c/9695df3b1db4ac4534274d38ee16e3b9b0bf910e"],"score":null,"solutions":"","state":"PUBLISHED","title":"asymmetric_keys: reject trust keys without IDs","updated_at":1794500401,"url":"https://www.clawpit.io/egret/cves/CVE-2026-99220","workarounds":""},{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/trace/ftrace.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"753d5cba113a52cb155428f4ea93a4b0148c4bf1","status":"affected","version":"b39181f7c6907dc66ff937b74758671fa6ba430c","versionType":"git"},{"lessThan":"0e5ff07be834abaf4280e1dca7f9591e339d0960","status":"affected","version":"b39181f7c6907dc66ff937b74758671fa6ba430c","versionType":"git"},{"lessThan":"e2e6fb972bfec4a0551bc7c185bdb17f78f94997","status":"affected","version":"b39181f7c6907dc66ff937b74758671fa6ba430c","versionType":"git"},{"lessThan":"8932e5a4df110a25578728526bb5a3dbc849d8a2","status":"affected","version":"b39181f7c6907dc66ff937b74758671fa6ba430c","versionType":"git"},{"lessThan":"7271c064dd60d4456c5b90da757acd9420d06697","status":"affected","version":"b39181f7c6907dc66ff937b74758671fa6ba430c","versionType":"git"},{"lessThan":"d97dba9ff13987d1fc415408557a54adde980311","status":"affected","version":"b39181f7c6907dc66ff937b74758671fa6ba430c","versionType":"git"},{"lessThan":"e1f339ff3b83857b93baf8b88186275a413d445e","status":"affected","version":"b39181f7c6907dc66ff937b74758671fa6ba430c","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["kernel/trace/ftrace.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.19"},{"lessThan":"5.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.161","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.115","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.60","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.14","versionType":"semver"},{"lessThanOrEqual":"7.3.*","status":"unaffected","version":"7.3.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.4-rc1","versionType":"original_commit_for_fix"}]}],"cna":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/trace/ftrace.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"753d5cba113a52cb155428f4ea93a4b0148c4bf1","status":"affected","version":"b39181f7c6907dc66ff937b74758671fa6ba430c","versionType":"git"},{"lessThan":"0e5ff07be834abaf4280e1dca7f9591e339d0960","status":"affected","version":"b39181f7c6907dc66ff937b74758671fa6ba430c","versionType":"git"},{"lessThan":"e2e6fb972bfec4a0551bc7c185bdb17f78f94997","status":"affected","version":"b39181f7c6907dc66ff937b74758671fa6ba430c","versionType":"git"},{"lessThan":"8932e5a4df110a25578728526bb5a3dbc849d8a2","status":"affected","version":"b39181f7c6907dc66ff937b74758671fa6ba430c","versionType":"git"},{"lessThan":"7271c064dd60d4456c5b90da757acd9420d06697","status":"affected","version":"b39181f7c6907dc66ff937b74758671fa6ba430c","versionType":"git"},{"lessThan":"d97dba9ff13987d1fc415408557a54adde980311","status":"affected","version":"b39181f7c6907dc66ff937b74758671fa6ba430c","versionType":"git"},{"lessThan":"e1f339ff3b83857b93baf8b88186275a413d445e","status":"affected","version":"b39181f7c6907dc66ff937b74758671fa6ba430c","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["kernel/trace/ftrace.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.19"},{"lessThan":"5.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.161","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.115","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.60","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.14","versionType":"semver"},{"lessThanOrEqual":"7.3.*","status":"unaffected","version":"7.3.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.4-rc1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.191","versionStartIncluding":"5.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.161","versionStartIncluding":"5.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.115","versionStartIncluding":"5.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.60","versionStartIncluding":"5.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.14","versionStartIncluding":"5.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3.1","versionStartIncluding":"5.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.4-rc1","versionStartIncluding":"5.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Initialize modname and offset in print_rec()\n\nprint_rec() leaves 'modname' and 'offset' uninitialized and\nkallsyms_lookup() only sets them on success. When the lookup fails like\nwhen a module is being loaded or unloaded, 'modname' holds a garbage\nvalue, passes the 'if (modname)' check, and is dereferenced by\nseq_printf().\n\n  Oops: general protection fault\n  RIP: 0010:string+0x48/0xe0\n  Call Trace:\n   vsnprintf+0x1f5/0x650\n   seq_printf+0x8e/0xb0\n   print_rec+0x6c/0xc0\n   t_show+0x4c/0x440\n   seq_read_iter+0x119/0x480\n\nThis can be triggered by reading available_filter_functions while a\nmodule is being loaded or unloaded.\n\nInitialize both variables so a failed lookup skips the module name."}],"providerMetadata":{"dateUpdated":"2026-11-03T19:12:54.203Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/753d5cba113a52cb155428f4ea93a4b0148c4bf1"},{"url":"https://git.kernel.org/stable/c/0e5ff07be834abaf4280e1dca7f9591e339d0960"},{"url":"https://git.kernel.org/stable/c/e2e6fb972bfec4a0551bc7c185bdb17f78f94997"},{"url":"https://git.kernel.org/stable/c/8932e5a4df110a25578728526bb5a3dbc849d8a2"},{"url":"https://git.kernel.org/stable/c/7271c064dd60d4456c5b90da757acd9420d06697"},{"url":"https://git.kernel.org/stable/c/d97dba9ff13987d1fc415408557a54adde980311"},{"url":"https://git.kernel.org/stable/c/e1f339ff3b83857b93baf8b88186275a413d445e"}],"title":"ftrace: Initialize modname and offset in print_rec()","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-99219","datePublished":"2026-11-02T16:06:31.529Z","dateReserved":"2026-09-25T10:25:14.401Z","dateUpdated":"2026-11-03T19:12:54.203Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794500401,"cve":"CVE-2026-99219","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Initialize modname and offset in print_rec()\n\nprint_rec() leaves 'modname' and 'offset' uninitialized and\nkallsyms_lookup() only sets them on success. When the lookup fails like\nwhen a module is being loaded or unloaded, 'modname' holds a garbage\nvalue, passes the 'if (modname)' check, and is dereferenced by\nseq_printf().\n\n  Oops: general protection fault\n  RIP: 0010:string+0x48/0xe0\n  Call Trace:\n   vsnprintf+0x1f5/0x650\n   seq_printf+0x8e/0xb0\n   print_rec+0x6c/0xc0\n   t_show+0x4c/0x440\n   seq_read_iter+0x119/0x480\n\nThis can be triggered by reading available_filter_functions while a\nmodule is being loaded or unloaded.\n\nInitialize both variables so a failed lookup skips the module name.","epss":{"date":"2026-11-12","epss":0.00173,"percentile":0.0681},"epss_checked":1794522003,"first_seen":1794378631,"kev":null,"kev_checked":1794522003,"products":"Linux Linux","references":["https://git.kernel.org/stable/c/753d5cba113a52cb155428f4ea93a4b0148c4bf1","https://git.kernel.org/stable/c/0e5ff07be834abaf4280e1dca7f9591e339d0960","https://git.kernel.org/stable/c/e2e6fb972bfec4a0551bc7c185bdb17f78f94997","https://git.kernel.org/stable/c/8932e5a4df110a25578728526bb5a3dbc849d8a2","https://git.kernel.org/stable/c/7271c064dd60d4456c5b90da757acd9420d06697","https://git.kernel.org/stable/c/d97dba9ff13987d1fc415408557a54adde980311","https://git.kernel.org/stable/c/e1f339ff3b83857b93baf8b88186275a413d445e"],"score":null,"solutions":"","state":"PUBLISHED","title":"ftrace: Initialize modname and offset in print_rec()","updated_at":1794500401,"url":"https://www.clawpit.io/egret/cves/CVE-2026-99219","workarounds":""},{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/coredump.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"fd0fbe84312fda2fc187428c92c50b7d03a9d24c","status":"affected","version":"a94e2d408eaedbd85aae259621d46fafc10479a2","versionType":"git"},{"lessThan":"71146c437bae59e5280f657965dc6d006ee3989b","status":"affected","version":"a94e2d408eaedbd85aae259621d46fafc10479a2","versionType":"git"},{"lessThan":"0fce73efee40c65ce26641c5d93942462f9e8307","status":"affected","version":"a94e2d408eaedbd85aae259621d46fafc10479a2","versionType":"git"},{"lessThan":"16e94ed90b1b02398e044d41fd1db34828daa08e","status":"affected","version":"a94e2d408eaedbd85aae259621d46fafc10479a2","versionType":"git"},{"lessThan":"a0f09ff4c6b93312e565cfe75d76c3a551a3ec4c","status":"affected","version":"a94e2d408eaedbd85aae259621d46fafc10479a2","versionType":"git"},{"lessThan":"b0eca0edddf4c1dbaf6d1f6a8636b4235f5bc573","status":"affected","version":"a94e2d408eaedbd85aae259621d46fafc10479a2","versionType":"git"},{"lessThan":"61d58591aa0188bf2463e263962256316ff8b576","status":"affected","version":"a94e2d408eaedbd85aae259621d46fafc10479a2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/coredump.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.27"},{"lessThan":"2.6.27","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.161","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.115","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.60","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.14","versionType":"semver"},{"lessThanOrEqual":"7.3.*","status":"unaffected","version":"7.3.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.4-rc1","versionType":"original_commit_for_fix"}]}],"cna":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/coredump.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"fd0fbe84312fda2fc187428c92c50b7d03a9d24c","status":"affected","version":"a94e2d408eaedbd85aae259621d46fafc10479a2","versionType":"git"},{"lessThan":"71146c437bae59e5280f657965dc6d006ee3989b","status":"affected","version":"a94e2d408eaedbd85aae259621d46fafc10479a2","versionType":"git"},{"lessThan":"0fce73efee40c65ce26641c5d93942462f9e8307","status":"affected","version":"a94e2d408eaedbd85aae259621d46fafc10479a2","versionType":"git"},{"lessThan":"16e94ed90b1b02398e044d41fd1db34828daa08e","status":"affected","version":"a94e2d408eaedbd85aae259621d46fafc10479a2","versionType":"git"},{"lessThan":"a0f09ff4c6b93312e565cfe75d76c3a551a3ec4c","status":"affected","version":"a94e2d408eaedbd85aae259621d46fafc10479a2","versionType":"git"},{"lessThan":"b0eca0edddf4c1dbaf6d1f6a8636b4235f5bc573","status":"affected","version":"a94e2d408eaedbd85aae259621d46fafc10479a2","versionType":"git"},{"lessThan":"61d58591aa0188bf2463e263962256316ff8b576","status":"affected","version":"a94e2d408eaedbd85aae259621d46fafc10479a2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/coredump.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.27"},{"lessThan":"2.6.27","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.161","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.115","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.60","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.14","versionType":"semver"},{"lessThanOrEqual":"7.3.*","status":"unaffected","version":"7.3.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.4-rc1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.191","versionStartIncluding":"2.6.27","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.161","versionStartIncluding":"2.6.27","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.115","versionStartIncluding":"2.6.27","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.60","versionStartIncluding":"2.6.27","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.14","versionStartIncluding":"2.6.27","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3.1","versionStartIncluding":"2.6.27","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.4-rc1","versionStartIncluding":"2.6.27","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncoredump: hold RCU while releasing parked threads\n\ncoredump_finish() releases the parked threads by clearing ->task in\ntheir core_thread entry and calling wake_up_process() on each of them.\nIt does that without holding a reference on the task and without being\ninside rcu.\n\nBut calling wake_up_process(task) without rcu here isn't safe. A parked\nthread doesn't need that wakeup to leave. A spurious wakeup or a\npreemption after the store is enough for the task to go away.\n\nSo if the coredump client is preempted between the store and\nwake_up_process() the thread can exit and be freed in the meantime and\ntry_to_wake_up() takes pi_lock in freed memory.\n\nHold rcu across the loop."}],"metrics":[{"cvssV3_1":{"baseScore":7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - The UAF is in coredump_finish(), reached when a local dump signal is delivered via get_signal() -> vfs_coredump() -> do_coredump()/coredump_cleanup(). abort(), a user page-fault SIGSEGV, or tgkill() on the attacker's own thread group starts that path; no remote protocol supplies the curr->task pointer later handed to wake_up_process().\nAC:H - coredump_wait() parks siblings in coredump_task_exit() in TASK_IDLE (no TASK_WAKEKILL), so kill/tgkill cannot wake them. The UAF needs the dumper preempted between curr->task=NULL and wake_up_process() long enough for a spurious or freezer wakeup, full do_exit(), and an RCU GP via delayed_put_task_struct() — timing the attacker cannot force.\nPR:L - get_signal() dumps the caller's own dumpable thread group with no capability check. An ordinary user pthread_create()s a sibling and abort()s or faults into vfs_coredump(); coredump_skip() only bails on TASK_DUMPABLE_OFF, which a normal user process is not.\nUI:N - The attacker creates the extra thread and delivers the dump signal inside their own process; no other user must mount media, open a file, or otherwise act.\nS:U - try_to_wake_up() on the freed task_struct corrupts host kernel scheduler state inside the same kernel; this is ordinary in-kernel UAF impact, not a VM, IOMMU, or sandbox escape.\nC:H - wake_up_process() -> try_to_wake_up() reads __state, on_rq, and sched_class from the task_struct after delayed_put_task_struct() has freed it; a sprayable slab UAF read is High confidentiality per UAF guidance.\nI:H - try_to_wake_up() takes raw_spin_lock on the freed p->pi_lock, writes __state, and calls p->sched_class->enqueue_task(); reclaiming the task_struct slab yields a write and control-flow primitive.\nA:H - Taking pi_lock in memory already freed by delayed_put_task_struct(), as the fix describes, oopses or panics even without a successful spray, so availability is High."}]}],"providerMetadata":{"dateUpdated":"2026-11-03T19:12:53.426Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/fd0fbe84312fda2fc187428c92c50b7d03a9d24c"},{"url":"https://git.kernel.org/stable/c/71146c437bae59e5280f657965dc6d006ee3989b"},{"url":"https://git.kernel.org/stable/c/0fce73efee40c65ce26641c5d93942462f9e8307"},{"url":"https://git.kernel.org/stable/c/16e94ed90b1b02398e044d41fd1db34828daa08e"},{"url":"https://git.kernel.org/stable/c/a0f09ff4c6b93312e565cfe75d76c3a551a3ec4c"},{"url":"https://git.kernel.org/stable/c/b0eca0edddf4c1dbaf6d1f6a8636b4235f5bc573"},{"url":"https://git.kernel.org/stable/c/61d58591aa0188bf2463e263962256316ff8b576"}],"title":"coredump: hold RCU while releasing parked threads","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-99218","datePublished":"2026-11-02T16:06:31.088Z","dateReserved":"2026-09-25T10:25:14.401Z","dateUpdated":"2026-11-03T19:12:53.426Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794500401,"cve":"CVE-2026-99218","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncoredump: hold RCU while releasing parked threads\n\ncoredump_finish() releases the parked threads by clearing ->task in\ntheir core_thread entry and calling wake_up_process() on each of them.\nIt does that without holding a reference on the task and without being\ninside rcu.\n\nBut calling wake_up_process(task) without rcu here isn't safe. A parked\nthread doesn't need that wakeup to leave. A spurious wakeup or a\npreemption after the store is enough for the task to go away.\n\nSo if the coredump client is preempted between the store and\nwake_up_process() the thread can exit and be freed in the meantime and\ntry_to_wake_up() takes pi_lock in freed memory.\n\nHold rcu across the loop.","epss":{"date":"2026-11-12","epss":0.00122,"percentile":0.02016},"epss_checked":1794522003,"first_seen":1794378631,"kev":null,"kev_checked":1794522003,"products":"Linux Linux","references":["https://git.kernel.org/stable/c/fd0fbe84312fda2fc187428c92c50b7d03a9d24c","https://git.kernel.org/stable/c/71146c437bae59e5280f657965dc6d006ee3989b","https://git.kernel.org/stable/c/0fce73efee40c65ce26641c5d93942462f9e8307","https://git.kernel.org/stable/c/16e94ed90b1b02398e044d41fd1db34828daa08e","https://git.kernel.org/stable/c/a0f09ff4c6b93312e565cfe75d76c3a551a3ec4c","https://git.kernel.org/stable/c/b0eca0edddf4c1dbaf6d1f6a8636b4235f5bc573","https://git.kernel.org/stable/c/61d58591aa0188bf2463e263962256316ff8b576"],"score":{"baseScore":7,"baseSeverity":"HIGH","provider":"Linux","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"solutions":"","state":"PUBLISHED","title":"coredump: hold RCU while releasing parked threads","updated_at":1794500401,"url":"https://www.clawpit.io/egret/cves/CVE-2026-99218","workarounds":""},{"affected":[{"product":"moleculer","vendor":"moleculerjs","versions":[{"status":"affected","version":">= 0.15.0, < 0.15.2"},{"status":"affected","version":"< 0.14.36"}]}],"cna":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-97705","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T19:18:32.217571Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-11-05T19:18:45.325Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"moleculer","vendor":"moleculerjs","versions":[{"status":"affected","version":">= 0.15.0, < 0.15.2"},{"status":"affected","version":"< 0.14.36"}]}],"descriptions":[{"lang":"en","value":"Moleculer is a progressive microservices framework for Node.js. Prior to 0.14.36 and 0.15.2, Parser._write in src/transporters/tcp/parser.js used Buffer.prototype.readInt32BE to read a signed packet length, so a remote unauthenticated peer could supply a negative value that caused packet.slice(length) to return the unchanged buffer while the while (packet.length > 0) loop continued indefinitely. The synchronous loop blocked the Node.js event loop and made every service in the process unresponsive until restart. The TCP transporter must be enabled and reachable, and neither CRC validation nor maxPacketSize prevents the malformed length value. This issue is fixed in versions 0.14.36 and 0.15.2."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-835","description":"CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-04T19:28:56.273Z","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M"},"references":[{"name":"https://github.com/moleculerjs/moleculer/security/advisories/GHSA-h89v-g948-47vp","tags":["x_refsource_CONFIRM"],"url":"https://github.com/moleculerjs/moleculer/security/advisories/GHSA-h89v-g948-47vp"},{"name":"https://github.com/moleculerjs/moleculer/commit/168ecbdc245c9a9d1dc4ef9b8a81dbae38ee3063","tags":["x_refsource_MISC"],"url":"https://github.com/moleculerjs/moleculer/commit/168ecbdc245c9a9d1dc4ef9b8a81dbae38ee3063"},{"name":"https://github.com/moleculerjs/moleculer/commit/914074e502ae403a0338ad168b45b16d6bcc3e44","tags":["x_refsource_MISC"],"url":"https://github.com/moleculerjs/moleculer/commit/914074e502ae403a0338ad168b45b16d6bcc3e44"},{"name":"https://github.com/moleculerjs/moleculer/releases/tag/v0.14.36","tags":["x_refsource_MISC"],"url":"https://github.com/moleculerjs/moleculer/releases/tag/v0.14.36"},{"name":"https://github.com/moleculerjs/moleculer/releases/tag/v0.15.2","tags":["x_refsource_MISC"],"url":"https://github.com/moleculerjs/moleculer/releases/tag/v0.15.2"}],"source":{"advisory":"GHSA-h89v-g948-47vp","discovery":"UNKNOWN"},"title":"Moleculer: Unauthenticated Denial of Service via negative length field in the TCP transporter packet parser"}},"cveMetadata":{"assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","assignerShortName":"GitHub_M","cveId":"CVE-2026-97705","datePublished":"2026-11-04T19:28:56.273Z","dateReserved":"2026-09-24T21:43:37.209Z","dateUpdated":"2026-11-05T19:18:45.325Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794435601,"cve":"CVE-2026-97705","description":"Moleculer is a progressive microservices framework for Node.js. Prior to 0.14.36 and 0.15.2, Parser._write in src/transporters/tcp/parser.js used Buffer.prototype.readInt32BE to read a signed packet length, so a remote unauthenticated peer could supply a negative value that caused packet.slice(length) to return the unchanged buffer while the while (packet.length > 0) loop continued indefinitely. The synchronous loop blocked the Node.js event loop and made every service in the process unresponsive until restart. The TCP transporter must be enabled and reachable, and neither CRC validation nor maxPacketSize prevents the malformed length value. This issue is fixed in versions 0.14.36 and 0.15.2.","epss":{"date":"2026-11-12","epss":0.0035,"percentile":0.29099},"epss_checked":1794522003,"first_seen":1794290405,"kev":null,"kev_checked":1794522003,"products":"moleculerjs moleculer","references":["https://github.com/moleculerjs/moleculer/security/advisories/GHSA-h89v-g948-47vp","https://github.com/moleculerjs/moleculer/commit/168ecbdc245c9a9d1dc4ef9b8a81dbae38ee3063","https://github.com/moleculerjs/moleculer/commit/914074e502ae403a0338ad168b45b16d6bcc3e44","https://github.com/moleculerjs/moleculer/releases/tag/v0.14.36","https://github.com/moleculerjs/moleculer/releases/tag/v0.15.2"],"score":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","provider":"GitHub_M","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"solutions":"","state":"PUBLISHED","title":"Moleculer: Unauthenticated Denial of Service via negative length field in the TCP transporter packet parser","updated_at":1794500401,"url":"https://www.clawpit.io/egret/cves/CVE-2026-97705","workarounds":""},{"affected":[{"product":"Console API","vendor":"Xerj","versions":[{"status":"affected","version":"v1.0.0-rc.11"}]}],"cna":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2026-10-20T19:07:07.888Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"url":"https://www.kb.cert.org/vuls/id/645818"}],"title":"CVE Program Container"},{"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}},{"other":{"content":{"id":"CVE-2026-97406","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-29T17:58:32.030214Z","version":"2.0.3"},"type":"ssvc"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-306","description":"CWE-306 Missing Authentication for Critical Function","lang":"en","type":"CWE"},{"cweId":"CWE-863","description":"CWE-863 Incorrect Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-29T17:58:37.254Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"Console API","vendor":"Xerj","versions":[{"status":"affected","version":"v1.0.0-rc.11"}]}],"descriptions":[{"lang":"en","value":"XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token creation endpoint, allowing unauthorized minting of persistent successor credentials."}],"problemTypes":[{"descriptions":[{"description":"CWE-306 Missing Authentication for Critical Function","lang":"en"}]},{"descriptions":[{"description":"CWE-863 Incorrect Authorization","lang":"en"}]}],"providerMetadata":{"dateUpdated":"2026-10-20T18:13:22.176Z","orgId":"37e5125f-f79b-445b-8fad-9564f167944b","shortName":"certcc"},"references":[{"url":"https://kb.cert.org/vuls/id/645818"}],"source":{"discovery":"UNKNOWN"},"title":"Authentication Bypass via Bearer Tokens to Unauthorized Credential Minting","x_generator":{"engine":"VINCE 3.0.50","env":"prod","origin":"https://cveawg.mitre.org/api/cve/CVE-2026-97406"}}},"cveMetadata":{"assignerOrgId":"37e5125f-f79b-445b-8fad-9564f167944b","assignerShortName":"certcc","cveId":"CVE-2026-97406","datePublished":"2026-10-20T18:11:08.475Z","dateReserved":"2026-09-24T14:49:55.504Z","dateUpdated":"2026-10-29T17:58:37.254Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794522003,"cve":"CVE-2026-97406","description":"XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token creation endpoint, allowing unauthorized minting of persistent successor credentials.","epss":{"date":"2026-11-12","epss":0.00531,"percentile":0.45386},"epss_checked":1794522003,"first_seen":1793665374,"kev":null,"kev_checked":1794522003,"products":"Xerj Console API","references":["https://kb.cert.org/vuls/id/645818","https://www.kb.cert.org/vuls/id/645818"],"score":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","provider":"CISA-ADP","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"solutions":"","state":"PUBLISHED","title":"Authentication Bypass via Bearer Tokens to Unauthorized Credential Minting","updated_at":1794500401,"url":"https://www.clawpit.io/egret/cves/CVE-2026-97406","workarounds":""},{"affected":[{"product":"ntopng","vendor":"ntop","versions":[{"status":"affected","version":"< 6.7.260721"}]}],"cna":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-97371","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T20:57:20.546560Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-11-05T20:57:38.887Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["exploit"],"url":"https://github.com/ntop/ntopng/security/advisories/GHSA-26jm-9qfw-89w7"}],"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"ntopng","vendor":"ntop","versions":[{"status":"affected","version":"< 6.7.260721"}]}],"descriptions":[{"lang":"en","value":"ntopng is a web-based network traffic monitoring application. Prior to 6.7.260721, ndpi_get_custom_category_match writes a four-byte nDPI protocol-category value through a pointer to the two-byte id variable in IpAddress::reloadBlacklist in src/IpAddress.cpp during packet dissection and host initialization. A remote unauthenticated attacker on a monitored network segment can send packets that match custom-category rules, causing stack corruption and denial of service without user interaction. This issue is fixed in version 6.7.260721."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-121","description":"CWE-121: Stack-based Buffer Overflow","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-05T16:06:00.745Z","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M"},"references":[{"name":"https://github.com/ntop/ntopng/security/advisories/GHSA-26jm-9qfw-89w7","tags":["x_refsource_CONFIRM"],"url":"https://github.com/ntop/ntopng/security/advisories/GHSA-26jm-9qfw-89w7"},{"name":"https://github.com/ntop/ntopng/commit/96acb6187950a6a49ca827e49973c3e0c27ea664","tags":["x_refsource_MISC"],"url":"https://github.com/ntop/ntopng/commit/96acb6187950a6a49ca827e49973c3e0c27ea664"}],"source":{"advisory":"GHSA-26jm-9qfw-89w7","discovery":"UNKNOWN"},"title":"ntopng: Stack buffer overflow (write) in nDPI custom category detection allows remote code execution via crafted network packets"}},"cveMetadata":{"assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","assignerShortName":"GitHub_M","cveId":"CVE-2026-97371","datePublished":"2026-11-05T16:06:00.745Z","dateReserved":"2026-09-24T14:16:20.200Z","dateUpdated":"2026-11-05T20:57:38.887Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794500401,"cve":"CVE-2026-97371","description":"ntopng is a web-based network traffic monitoring application. Prior to 6.7.260721, ndpi_get_custom_category_match writes a four-byte nDPI protocol-category value through a pointer to the two-byte id variable in IpAddress::reloadBlacklist in src/IpAddress.cpp during packet dissection and host initialization. A remote unauthenticated attacker on a monitored network segment can send packets that match custom-category rules, causing stack corruption and denial of service without user interaction. This issue is fixed in version 6.7.260721.","epss":{"date":"2026-11-12","epss":0.00484,"percentile":0.42211},"epss_checked":1794522003,"first_seen":1794378631,"kev":null,"kev_checked":1794522003,"products":"ntop ntopng","references":["https://github.com/ntop/ntopng/security/advisories/GHSA-26jm-9qfw-89w7","https://github.com/ntop/ntopng/commit/96acb6187950a6a49ca827e49973c3e0c27ea664"],"score":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","provider":"GitHub_M","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"solutions":"","state":"PUBLISHED","title":"ntopng: Stack buffer overflow (write) in nDPI custom category detection allows remote code execution via crafted network packets","updated_at":1794500401,"url":"https://www.clawpit.io/egret/cves/CVE-2026-97371","workarounds":""},{"affected":[{"cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"GitLab","repo":"https://gitlab.com/gitlab-org/gitlab","vendor":"GitLab","versions":[{"lessThan":"19.2.8","status":"affected","version":"19.2","versionType":"semver"},{"lessThan":"19.3.5","status":"affected","version":"19.3","versionType":"semver"},{"lessThan":"19.4.2","status":"affected","version":"19.4","versionType":"semver"}]}],"cna":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-97229","options":[{"Exploitation":"active"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-13T00:00:00+00:00","version":"2.0.3"},"type":"ssvc"}},{"other":{"content":{"dateAdded":"2026-10-29","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-97229"},"type":"kev"}}],"providerMetadata":{"dateUpdated":"2026-10-30T03:55:54.495Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-97229"}],"timeline":[{"lang":"en","time":"2026-10-29T00:00:00.000Z","value":"CVE-2026-97229 added to CISA KEV"}],"title":"CISA ADP Vulnrichment"},{"providerMetadata":{"dateUpdated":"2026-10-30T23:18:16.598Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"url":"https://github.com/rapid7/metasploit-framework/pull/22017"},{"url":"https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/"}],"title":"CVE Program Container","x_generator":{"engine":"ADPogram 0.0.1"}}],"cna":{"affected":[{"cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"GitLab","repo":"https://gitlab.com/gitlab-org/gitlab","vendor":"GitLab","versions":[{"lessThan":"19.2.8","status":"affected","version":"19.2","versionType":"semver"},{"lessThan":"19.3.5","status":"affected","version":"19.3","versionType":"semver"},{"lessThan":"19.4.2","status":"affected","version":"19.4","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"Thanks [joaxcar](https://hackerone.com/joaxcar) for reporting this vulnerability through our HackerOne bug bounty program"}],"descriptions":[{"lang":"en","value":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":10,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-190","description":"CWE-190: Integer Overflow or Wraparound","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-13T01:05:46.166Z","orgId":"ceab7361-8a18-47b1-92ba-4d7d25f6715a","shortName":"GitLab"},"references":[{"url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/630686"},{"name":"HackerOne Bug Bounty Report #4055749","tags":["technical-description","exploit","permissions-required"],"url":"https://hackerone.com/reports/4055749"},{"name":"HackerOne Bug Bounty Report #4058589","tags":["technical-description","exploit","permissions-required"],"url":"https://hackerone.com/reports/4058589"},{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/"}],"solutions":[{"lang":"en","value":"Upgrade to versions 19.2.8, 19.3.5, 19.4.2 or above."}],"title":"Integer Overflow or Wraparound in GitLab"}},"cveMetadata":{"assignerOrgId":"ceab7361-8a18-47b1-92ba-4d7d25f6715a","assignerShortName":"GitLab","cveId":"CVE-2026-97229","datePublished":"2026-10-13T01:05:46.166Z","dateReserved":"2026-09-24T10:04:47.421Z","dateUpdated":"2026-10-30T23:18:16.598Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794522003,"cve":"CVE-2026-97229","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.","epss":{"date":"2026-11-12","epss":0.69289,"percentile":0.99368},"epss_checked":1794522003,"first_seen":1793665374,"kev":{"cveID":"CVE-2026-97229","cwes":["CWE-190"],"dateAdded":"2026-10-29","dueDate":"2026-11-01","forensicTriage":"Yes","knownRansomwareCampaignUse":"Unknown","notes":"Other products can potentially be affected by the same underlying Ruby/Onigmo Integer Overflow issue in CI/CD Regular Expression Compiler. For more information please see: https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves ; https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-97229","product":"Community Edition and Enterprise Edition","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","shortDescription":"GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.","vendorProject":"GitLab","vulnerabilityName":"GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability"},"kev_checked":1794522003,"products":"GitLab GitLab","references":["https://gitlab.com/gitlab-org/gitlab/-/work_items/630686","https://hackerone.com/reports/4055749","https://hackerone.com/reports/4058589","https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-97229","https://github.com/rapid7/metasploit-framework/pull/22017","https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/"],"score":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":10,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","provider":"GitLab","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"solutions":"Upgrade to versions 19.2.8, 19.3.5, 19.4.2 or above.","state":"PUBLISHED","title":"Integer Overflow or Wraparound in GitLab","updated_at":1794500401,"url":"https://www.clawpit.io/egret/cves/CVE-2026-97229","workarounds":""},{"affected":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"cna":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-97013","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:23:13.192069Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-11-11T00:24:29.834Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*","versionEndExcluding":"10.0.17763.9487","versionStartIncluding":"10.0.17763.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.17763.9487","versionStartIncluding":"10.0.17763.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.17763.9487","versionStartIncluding":"10.0.17763.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.20348.5870","versionStartIncluding":"10.0.20348.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_10_21H2:*:*:*:*:*:*:x86:*","versionEndExcluding":"10.0.19044.7846","versionStartIncluding":"10.0.19044.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_10_22H2:*:*:*:*:*:*:x64:*","versionEndExcluding":"10.0.19045.7846","versionStartIncluding":"10.0.19045.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.26100.33822","versionStartIncluding":"10.0.26100.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_11_25H2:*:*:*:*:*:*:arm64:*","versionEndExcluding":"10.0.26200.9974","versionStartIncluding":"10.0.26200.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_11_23H2:*:*:*:*:*:*:arm64:*","versionEndExcluding":"10.0.22631.7711","versionStartIncluding":"10.0.22631.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_11_23H2:*:*:*:*:*:*:x64:*","versionEndExcluding":"10.0.22631.7711","versionStartIncluding":"10.0.22631.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_11_24H2:*:*:*:*:*:*:arm64:*","versionEndExcluding":"10.0.26100.9974","versionStartIncluding":"10.0.26100.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.26100.33822","versionStartIncluding":"10.0.26100.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_11_26H1:*:*:*:*:*:*:x64:*","versionEndExcluding":"10.0.28000.3501","versionStartIncluding":"10.0.28000.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*","versionEndExcluding":"10.0.14393.9688","versionStartIncluding":"10.0.14393.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.14393.9688","versionStartIncluding":"10.0.14393.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.14393.9688","versionStartIncluding":"10.0.14393.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:windows_11_version_26h2_for_arm64-based_systems:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.26300.9974","versionStartIncluding":"10.0.26300.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"datePublic":"2026-11-10T16:00:00.000Z","descriptions":[{"lang":"en-US","value":"Access of resource using incompatible type ('type confusion') in Windows Shell allows an authorized attacker to elevate privileges locally."}],"metrics":[{"cvssV3_1":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-843","description":"CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')","lang":"en-US","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-11T17:11:54.999Z","orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","shortName":"microsoft"},"references":[{"name":"Windows Shell Elevation of Privilege Vulnerability","tags":["vendor-advisory","patch"],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97013"}],"title":"Windows Shell Elevation of Privilege Vulnerability"}},"cveMetadata":{"assignerOrgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","assignerShortName":"microsoft","cveId":"CVE-2026-97013","datePublished":"2026-11-10T18:16:41.916Z","dateReserved":"2026-09-23T20:52:28.739Z","dateUpdated":"2026-11-11T17:11:54.999Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794478802,"cve":"CVE-2026-97013","description":"Access of resource using incompatible type ('type confusion') in Windows Shell allows an authorized attacker to elevate privileges locally.","epss":{"date":"2026-11-12","epss":0.00341,"percentile":0.28007},"epss_checked":1794522003,"first_seen":1794467710,"kev":null,"kev_checked":1794522003,"products":"Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation)","references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97013"],"score":{"baseScore":7.8,"baseSeverity":"HIGH","provider":"microsoft","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","version":"3.1"},"solutions":"","state":"PUBLISHED","title":"Windows Shell Elevation of Privilege Vulnerability","updated_at":1794500401,"url":"https://www.clawpit.io/egret/cves/CVE-2026-97013","workarounds":""},{"affected":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"cna":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-96982","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T01:12:10.969921Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-11-11T01:12:39.992Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*","versionEndExcluding":"10.0.14393.9688","versionStartIncluding":"10.0.14393.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.14393.9688","versionStartIncluding":"10.0.14393.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.14393.9688","versionStartIncluding":"10.0.14393.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*","versionEndExcluding":"10.0.17763.9487","versionStartIncluding":"10.0.17763.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.17763.9487","versionStartIncluding":"10.0.17763.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.17763.9487","versionStartIncluding":"10.0.17763.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_10_21H2:*:*:*:*:*:*:x86:*","versionEndExcluding":"10.0.19044.7846","versionStartIncluding":"10.0.19044.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_10_22H2:*:*:*:*:*:*:x86:*","versionEndExcluding":"10.0.19045.7846","versionStartIncluding":"10.0.19045.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.20348.5870","versionStartIncluding":"10.0.20348.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_11_23H2:*:*:*:*:*:*:arm64:*","versionEndExcluding":"10.0.22631.7711","versionStartIncluding":"10.0.22631.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_11_23H2:*:*:*:*:*:*:x64:*","versionEndExcluding":"10.0.22631.7711","versionStartIncluding":"10.0.22631.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_11_24H2:*:*:*:*:*:*:arm64:*","versionEndExcluding":"10.0.26100.9974","versionStartIncluding":"10.0.26100.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_11_25H2:*:*:*:*:*:*:arm64:*","versionEndExcluding":"10.0.26200.9974","versionStartIncluding":"10.0.26200.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:windows_11_version_26h2_for_arm64-based_systems:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.26300.9974","versionStartIncluding":"10.0.26300.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.26100.33822","versionStartIncluding":"10.0.26100.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.26100.33822","versionStartIncluding":"10.0.26100.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_11_26H1:*:*:*:*:*:*:arm64:*","versionEndExcluding":"10.0.28000.3501","versionStartIncluding":"10.0.28000.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"datePublic":"2026-11-10T16:00:00.000Z","descriptions":[{"lang":"en-US","value":"Integer overflow or wraparound in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack."}],"metrics":[{"cvssV3_1":{"baseScore":6.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-190","description":"CWE-190: Integer Overflow or Wraparound","lang":"en-US","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-12T15:42:59.580Z","orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","shortName":"microsoft"},"references":[{"name":"HID Parser Library Elevation of Privilege Vulnerability","tags":["vendor-advisory","patch"],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96982"}],"title":"HID Parser Library Elevation of Privilege Vulnerability"}},"cveMetadata":{"assignerOrgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","assignerShortName":"microsoft","cveId":"CVE-2026-96982","datePublished":"2026-11-10T18:17:52.053Z","dateReserved":"2026-09-23T20:39:09.977Z","dateUpdated":"2026-11-12T15:42:59.580Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794500401,"cve":"CVE-2026-96982","description":"Integer overflow or wraparound in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack.","epss":{"date":"2026-11-12","epss":0.00448,"percentile":0.39403},"epss_checked":1794522003,"first_seen":1794378631,"kev":null,"kev_checked":1794522003,"products":"Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation)","references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96982"],"score":{"baseScore":6.8,"baseSeverity":"MEDIUM","provider":"microsoft","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","version":"3.1"},"solutions":"","state":"PUBLISHED","title":"HID Parser Library Elevation of Privilege Vulnerability","updated_at":1794500401,"url":"https://www.clawpit.io/egret/cves/CVE-2026-96982","workarounds":""},{"affected":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"cna":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-96979","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T01:12:21.250220Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-11-11T01:13:12.988Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*","versionEndExcluding":"10.0.14393.9688","versionStartIncluding":"10.0.14393.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.14393.9688","versionStartIncluding":"10.0.14393.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.14393.9688","versionStartIncluding":"10.0.14393.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*","versionEndExcluding":"10.0.17763.9487","versionStartIncluding":"10.0.17763.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.17763.9487","versionStartIncluding":"10.0.17763.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.17763.9487","versionStartIncluding":"10.0.17763.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_10_21H2:*:*:*:*:*:*:x86:*","versionEndExcluding":"10.0.19044.7846","versionStartIncluding":"10.0.19044.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_10_22H2:*:*:*:*:*:*:x86:*","versionEndExcluding":"10.0.19045.7846","versionStartIncluding":"10.0.19045.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.20348.5870","versionStartIncluding":"10.0.20348.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_11_23H2:*:*:*:*:*:*:arm64:*","versionEndExcluding":"10.0.22631.7711","versionStartIncluding":"10.0.22631.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_11_23H2:*:*:*:*:*:*:x64:*","versionEndExcluding":"10.0.22631.7711","versionStartIncluding":"10.0.22631.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_11_24H2:*:*:*:*:*:*:arm64:*","versionEndExcluding":"10.0.26100.9974","versionStartIncluding":"10.0.26100.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_11_25H2:*:*:*:*:*:*:arm64:*","versionEndExcluding":"10.0.26200.9974","versionStartIncluding":"10.0.26200.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:windows_11_version_26h2_for_arm64-based_systems:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.26300.9974","versionStartIncluding":"10.0.26300.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.26100.33822","versionStartIncluding":"10.0.26100.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.26100.33822","versionStartIncluding":"10.0.26100.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_11_26H1:*:*:*:*:*:*:arm64:*","versionEndExcluding":"10.0.28000.3501","versionStartIncluding":"10.0.28000.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"datePublic":"2026-11-10T16:00:00.000Z","descriptions":[{"lang":"en-US","value":"Integer overflow or wraparound in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack."}],"metrics":[{"cvssV3_1":{"baseScore":6.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-190","description":"CWE-190: Integer Overflow or Wraparound","lang":"en-US","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-12T15:43:01.267Z","orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","shortName":"microsoft"},"references":[{"name":"HID Parser Library Elevation of Privilege Vulnerability","tags":["vendor-advisory","patch"],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96979"}],"title":"HID Parser Library Elevation of Privilege Vulnerability"}},"cveMetadata":{"assignerOrgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","assignerShortName":"microsoft","cveId":"CVE-2026-96979","datePublished":"2026-11-10T18:17:53.620Z","dateReserved":"2026-09-23T20:39:09.977Z","dateUpdated":"2026-11-12T15:43:01.267Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794500401,"cve":"CVE-2026-96979","description":"Integer overflow or wraparound in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack.","epss":{"date":"2026-11-12","epss":0.00448,"percentile":0.39404},"epss_checked":1794522003,"first_seen":1794378631,"kev":null,"kev_checked":1794522003,"products":"Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation)","references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96979"],"score":{"baseScore":6.8,"baseSeverity":"MEDIUM","provider":"microsoft","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","version":"3.1"},"solutions":"","state":"PUBLISHED","title":"HID Parser Library Elevation of Privilege Vulnerability","updated_at":1794500401,"url":"https://www.clawpit.io/egret/cves/CVE-2026-96979","workarounds":""},{"affected":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"cna":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-96974","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T01:12:26.665552Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-11-11T01:13:28.411Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*","versionEndExcluding":"10.0.14393.9688","versionStartIncluding":"10.0.14393.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.14393.9688","versionStartIncluding":"10.0.14393.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.14393.9688","versionStartIncluding":"10.0.14393.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*","versionEndExcluding":"10.0.17763.9487","versionStartIncluding":"10.0.17763.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.17763.9487","versionStartIncluding":"10.0.17763.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.17763.9487","versionStartIncluding":"10.0.17763.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_10_21H2:*:*:*:*:*:*:x86:*","versionEndExcluding":"10.0.19044.7846","versionStartIncluding":"10.0.19044.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_10_22H2:*:*:*:*:*:*:x86:*","versionEndExcluding":"10.0.19045.7846","versionStartIncluding":"10.0.19045.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.20348.5870","versionStartIncluding":"10.0.20348.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_11_23H2:*:*:*:*:*:*:arm64:*","versionEndExcluding":"10.0.22631.7711","versionStartIncluding":"10.0.22631.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_11_23H2:*:*:*:*:*:*:x64:*","versionEndExcluding":"10.0.22631.7711","versionStartIncluding":"10.0.22631.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_11_24H2:*:*:*:*:*:*:arm64:*","versionEndExcluding":"10.0.26100.9974","versionStartIncluding":"10.0.26100.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_11_25H2:*:*:*:*:*:*:arm64:*","versionEndExcluding":"10.0.26200.9974","versionStartIncluding":"10.0.26200.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:windows_11_version_26h2_for_arm64-based_systems:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.26300.9974","versionStartIncluding":"10.0.26300.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.26100.33822","versionStartIncluding":"10.0.26100.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.26100.33822","versionStartIncluding":"10.0.26100.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_11_26H1:*:*:*:*:*:*:arm64:*","versionEndExcluding":"10.0.28000.3501","versionStartIncluding":"10.0.28000.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"datePublic":"2026-11-10T16:00:00.000Z","descriptions":[{"lang":"en-US","value":"Integer overflow or wraparound in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack."}],"metrics":[{"cvssV3_1":{"baseScore":6.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-190","description":"CWE-190: Integer Overflow or Wraparound","lang":"en-US","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-12T15:42:59.145Z","orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","shortName":"microsoft"},"references":[{"name":"HID Parser Library Elevation of Privilege Vulnerability","tags":["vendor-advisory","patch"],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96974"}],"title":"HID Parser Library Elevation of Privilege Vulnerability"}},"cveMetadata":{"assignerOrgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","assignerShortName":"microsoft","cveId":"CVE-2026-96974","datePublished":"2026-11-10T18:17:51.606Z","dateReserved":"2026-09-23T20:39:09.977Z","dateUpdated":"2026-11-12T15:42:59.145Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794500401,"cve":"CVE-2026-96974","description":"Integer overflow or wraparound in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack.","epss":{"date":"2026-11-12","epss":0.00393,"percentile":0.34006},"epss_checked":1794522003,"first_seen":1794378631,"kev":null,"kev_checked":1794522003,"products":"Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation)","references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96974"],"score":{"baseScore":6.8,"baseSeverity":"MEDIUM","provider":"microsoft","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","version":"3.1"},"solutions":"","state":"PUBLISHED","title":"HID Parser Library Elevation of Privilege Vulnerability","updated_at":1794500401,"url":"https://www.clawpit.io/egret/cves/CVE-2026-96974","workarounds":""},{"affected":[{"product":"Microsoft Edge (Chromium-based)","vendor":"Microsoft","versions":[{"lessThan":"154.0.4258.62","status":"affected","version":"1.0.0.0","versionType":"custom"}]},{"product":"Outlook.com","vendor":"Microsoft","versions":[{"lessThan":"20260925.100","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9612","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9376","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7807","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7807","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7652","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7652","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9711","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9711","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3231","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9711","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2012 R2","vendor":"Microsoft","versions":[{"lessThan":"6.3.9600.23470","status":"affected","version":"6.3.9600.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2012 R2 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"6.3.9600.23470","status":"affected","version":"6.3.9600.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9612","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9612","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9376","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9376","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5761","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33650","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33650","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"cna":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-96951","options":[{"Exploitation":"active"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-08T00:00:00+00:00","version":"2.0.3"},"type":"ssvc"}},{"other":{"content":{"dateAdded":"2026-10-13","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96951"},"type":"kev"}}],"providerMetadata":{"dateUpdated":"2026-10-16T03:56:31.910Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96951"}],"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"Microsoft Edge (Chromium-based)","vendor":"Microsoft","versions":[{"lessThan":"154.0.4258.62","status":"affected","version":"1.0.0.0","versionType":"custom"}]},{"product":"Outlook.com","vendor":"Microsoft","versions":[{"lessThan":"20260925.100","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9612","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9376","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7807","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7807","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7652","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7652","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9711","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9711","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3231","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9711","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2012 R2","vendor":"Microsoft","versions":[{"lessThan":"6.3.9600.23470","status":"affected","version":"6.3.9600.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2012 R2 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"6.3.9600.23470","status":"affected","version":"6.3.9600.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9612","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9612","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9376","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9376","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5761","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33650","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33650","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:microsoft:windows_server_2012_R2:*:*:*:*:*:*:x64:*","versionEndExcluding":"6.3.9600.23470","versionStartIncluding":"6.3.9600.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_server_2012_R2:*:*:*:*:*:*:x64:*","versionEndExcluding":"6.3.9600.23470","versionStartIncluding":"6.3.9600.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*","versionEndExcluding":"10.0.14393.9612","versionStartIncluding":"10.0.14393.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.14393.9612","versionStartIncluding":"10.0.14393.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.14393.9612","versionStartIncluding":"10.0.14393.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*","versionEndExcluding":"10.0.17763.9376","versionStartIncluding":"10.0.17763.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.17763.9376","versionStartIncluding":"10.0.17763.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.17763.9376","versionStartIncluding":"10.0.17763.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_10_21H2:*:*:*:*:*:*:x86:*","versionEndExcluding":"10.0.19044.7807","versionStartIncluding":"10.0.19044.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_10_22H2:*:*:*:*:*:*:x86:*","versionEndExcluding":"10.0.19045.7807","versionStartIncluding":"10.0.19045.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.20348.5761","versionStartIncluding":"10.0.20348.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_11_23H2:*:*:*:*:*:*:arm64:*","versionEndExcluding":"10.0.22631.7652","versionStartIncluding":"10.0.22631.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_11_23H2:*:*:*:*:*:*:x64:*","versionEndExcluding":"10.0.22631.7652","versionStartIncluding":"10.0.22631.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_11_24H2:*:*:*:*:*:*:arm64:*","versionEndExcluding":"10.0.26100.9711","versionStartIncluding":"10.0.26100.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_11_25H2:*:*:*:*:*:*:arm64:*","versionEndExcluding":"10.0.26200.9711","versionStartIncluding":"10.0.26200.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:windows_11_version_26h2_for_arm64-based_systems:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.26300.9711","versionStartIncluding":"10.0.26300.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.26100.33650","versionStartIncluding":"10.0.26100.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.26100.33650","versionStartIncluding":"10.0.26100.0","vulnerable":true},{"criteria":"cpe:2.3:o:microsoft:windows_11_26H1:*:*:*:*:*:*:arm64:*","versionEndExcluding":"10.0.28000.3231","versionStartIncluding":"10.0.28000.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:outlook.com:*:*:*:*:*:*:*:*","versionEndExcluding":"20260925.100","versionStartIncluding":"1.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*","versionEndExcluding":"154.0.4258.62","versionStartIncluding":"1.0.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"datePublic":"2026-10-13T14:00:00.000Z","descriptions":[{"lang":"en-US","value":"Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network."}],"metrics":[{"cvssV3_1":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-77","description":"CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')","lang":"en-US","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-10T20:45:19.210Z","orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","shortName":"microsoft"},"references":[{"name":"Windows Shell Security Feature Bypass Vulnerability","tags":["vendor-advisory","patch"],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951"}],"title":"Windows Shell Security Feature Bypass Vulnerability"}},"cveMetadata":{"assignerOrgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","assignerShortName":"microsoft","cveId":"CVE-2026-96951","datePublished":"2026-10-13T19:01:26.801Z","dateReserved":"2026-09-23T20:35:19.928Z","dateUpdated":"2026-11-10T20:45:19.210Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794522003,"cve":"CVE-2026-96951","description":"Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.","epss":{"date":"2026-11-12","epss":0.09813,"percentile":0.95616},"epss_checked":1794522003,"first_seen":1793665374,"kev":{"cveID":"CVE-2026-96951","cwes":["CWE-77"],"dateAdded":"2026-10-13","dueDate":"2026-10-16","forensicTriage":"Yes","knownRansomwareCampaignUse":"Unknown","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-96951 ; BOD 26-04: BOD 26-04: Prioritizing Security Updates Based on Risk | CISA ; Forensics Triage Requirements: BOD 26-04: Implementation Guidance for Prioritizing Security Updates Based on Risk | CISA ;  https://nvd.nist.gov/vuln/detail/CVE-2026-96951","product":"Windows","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","shortDescription":"Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.","vendorProject":"Microsoft","vulnerabilityName":"Microsoft Windows Command Injection Vulnerability"},"kev_checked":1794522003,"products":"Microsoft Microsoft Edge (Chromium-based), Microsoft Outlook.com, Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2012 R2, Microsoft Windows Server 2012 R2 (Server Core installation), Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation)","references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96951"],"score":{"baseScore":8.8,"baseSeverity":"HIGH","provider":"microsoft","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C","version":"3.1"},"solutions":"","state":"PUBLISHED","title":"Windows Shell Security Feature Bypass Vulnerability","updated_at":1794500401,"url":"https://www.clawpit.io/egret/cves/CVE-2026-96951","workarounds":""},{"affected":[{"product":"Authlib","vendor":"Authlib","versions":[{"status":"affected","version":"1.8.0"}]}],"cna":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2026-09-28T20:07:57.835Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"url":"https://www.kb.cert.org/vuls/id/762428"}],"title":"CVE Program Container"},{"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}},{"other":{"content":{"id":"CVE-2026-96760","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-01T13:57:45.534196Z","version":"2.0.3"},"type":"ssvc"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-347","description":"CWE-347 Improper Verification of Cryptographic Signature","lang":"en","type":"CWE"},{"cweId":"CWE-670","description":"CWE-670 Always-Incorrect Control Flow Implementation","lang":"en","type":"CWE"},{"cweId":"CWE-358","description":"CWE-358 Improperly Implemented Security Check for Standard","lang":"en","type":"CWE"},{"cweId":"CWE-20","description":"CWE-20 Improper Input Validation","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-01T13:58:32.806Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"Authlib","vendor":"Authlib","versions":[{"status":"affected","version":"1.8.0"}]}],"descriptions":[{"lang":"en","value":"Authlib (v1.8.0 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key."}],"problemTypes":[{"descriptions":[{"description":"CWE-347 Improper Verification of Cryptographic Signature","lang":"en"}]},{"descriptions":[{"description":"CWE-670 Always-Incorrect Control Flow Implementation","lang":"en"}]},{"descriptions":[{"description":"CWE-358 Improperly Implemented Security Check for Standard","lang":"en"}]},{"descriptions":[{"description":"CWE-20 Improper Input Validation","lang":"en"}]}],"providerMetadata":{"dateUpdated":"2026-11-11T15:46:59.138Z","orgId":"37e5125f-f79b-445b-8fad-9564f167944b","shortName":"certcc"},"references":[{"url":"https://github.com/authlib/authlib"},{"url":"https://kb.cert.org/vuls/id/762428"}],"source":{"discovery":"UNKNOWN"},"title":"Authlib library contains a signature‑verification bypass vulnerability","x_generator":{"engine":"VINCE 4.0.2","env":"prod","origin":"https://cveawg.mitre.org/api/cve/CVE-2026-96760"}}},"cveMetadata":{"assignerOrgId":"37e5125f-f79b-445b-8fad-9564f167944b","assignerShortName":"certcc","cveId":"CVE-2026-96760","datePublished":"2026-09-28T19:37:58.973Z","dateReserved":"2026-09-23T15:59:27.145Z","dateUpdated":"2026-11-11T15:46:59.138Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794522003,"cve":"CVE-2026-96760","description":"Authlib (v1.8.0 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key.","epss":{"date":"2026-11-12","epss":0.00433,"percentile":0.38071},"epss_checked":1794522003,"first_seen":1793665374,"kev":null,"kev_checked":1794522003,"products":"Authlib Authlib","references":["https://github.com/authlib/authlib","https://kb.cert.org/vuls/id/762428","https://www.kb.cert.org/vuls/id/762428"],"score":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","provider":"CISA-ADP","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"solutions":"","state":"PUBLISHED","title":"Authlib library contains a signature‑verification bypass vulnerability","updated_at":1794500401,"url":"https://www.clawpit.io/egret/cves/CVE-2026-96760","workarounds":""},{"affected":[{"defaultStatus":"unknown","product":"Media Server","vendor":"Plex","versions":[{"lessThan":"1.43.3.10861","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"1.43.3.10861"}]}],"cna":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-96656","options":[{"Exploitation":"active"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-19T00:00:00+00:00","version":"2.0.3"},"type":"ssvc"}},{"other":{"content":{"dateAdded":"2026-10-20","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96656"},"type":"kev"}}],"providerMetadata":{"dateUpdated":"2026-10-21T03:56:10.489Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["third-party-advisory"],"url":"https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html"},{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96656"}],"timeline":[{"lang":"en","time":"2026-10-20T00:00:00.000Z","value":"CVE-2026-96656 added to CISA KEV"}],"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unknown","product":"Media Server","vendor":"Plex","versions":[{"lessThan":"1.43.3.10861","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"1.43.3.10861"}]}],"credits":[{"lang":"en","value":"Zach Main"}],"datePublic":"2026-08-03T00:00:00.000Z","descriptions":[{"lang":"en","value":"Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks."}],"metrics":[{"cvssV4_0":{"attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.6,"baseSeverity":"HIGH","privilegesRequired":"HIGH","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}},{"other":{"content":{"id":"CVE-2026-96656","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-09-14T18:24:56.053053Z","version":"2.0.3"},"type":"ssvc"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-73","description":"CWE-73 External Control of File Name or Path","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-23T16:07:10.048Z","orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg"},"references":[{"name":"url","tags":["release-notes"],"url":"https://forums.plex.tv/t/plex-media-server/30447/711"},{"name":"url","tags":["vdb-entry"],"url":"https://www.cve.org/CVERecord?id=CVE-2026-96656"},{"name":"url","tags":["third-party-advisory"],"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json"},{"name":"url","tags":["third-party-advisory"],"url":"https://zmain.info/blog/plex2shell"}],"title":"Plex Media Server arbitrary file write"}},"cveMetadata":{"assignerOrgId":"9119a7d8-5eab-497f-8521-727c672e3725","assignerShortName":"cisa-cg","cveId":"CVE-2026-96656","datePublished":"2026-09-23T16:07:10.048Z","dateReserved":"2026-09-23T14:42:33.270Z","dateUpdated":"2026-10-21T03:56:10.489Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794522003,"cve":"CVE-2026-96656","description":"Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.","epss":{"date":"2026-11-12","epss":0.01785,"percentile":0.78621},"epss_checked":1794522003,"first_seen":1793665374,"kev":{"cveID":"CVE-2026-96656","cwes":["CWE-73"],"dateAdded":"2026-10-20","dueDate":"2026-10-23","forensicTriage":"Yes","knownRansomwareCampaignUse":"Unknown","notes":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-96656","product":"Media Server","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","shortDescription":"Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.","vendorProject":"Plex","vulnerabilityName":"Plex Media Server External Control of File Name or Path Vulnerability"},"kev_checked":1794522003,"products":"Plex Media Server","references":["https://forums.plex.tv/t/plex-media-server/30447/711","https://www.cve.org/CVERecord?id=CVE-2026-96656","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json","https://zmain.info/blog/plex2shell","https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96656"],"score":{"attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.6,"baseSeverity":"HIGH","privilegesRequired":"HIGH","provider":"cisa-cg","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH"},"solutions":"","state":"PUBLISHED","title":"Plex Media Server arbitrary file write","updated_at":1794500401,"url":"https://www.clawpit.io/egret/cves/CVE-2026-96656","workarounds":""},{"affected":[{"defaultStatus":"unknown","product":"Media Server","vendor":"Plex","versions":[{"lessThan":"1.43.3.10861","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"1.43.3.10861"}]}],"cna":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-96655","options":[{"Exploitation":"active"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-20T00:00:00+00:00","version":"2.0.3"},"type":"ssvc"}},{"other":{"content":{"dateAdded":"2026-10-20","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96655"},"type":"kev"}}],"providerMetadata":{"dateUpdated":"2026-10-21T03:56:24.883Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96655"}],"timeline":[{"lang":"en","time":"2026-10-20T00:00:00.000Z","value":"CVE-2026-96655 added to CISA KEV"}],"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unknown","product":"Media Server","vendor":"Plex","versions":[{"lessThan":"1.43.3.10861","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"1.43.3.10861"}]}],"credits":[{"lang":"en","value":"Zach Main"}],"datePublic":"2026-08-03T00:00:00.000Z","descriptions":[{"lang":"en","value":"Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"}},{"cvssV4_0":{"attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":5.3,"baseSeverity":"MEDIUM","privilegesRequired":"LOW","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE"}},{"other":{"content":{"id":"CVE-2026-96655","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-09-14T18:23:48.400949Z","version":"2.0.3"},"type":"ssvc"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-918","description":"CWE-918 Server-Side Request Forgery (SSRF)","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-23T16:06:53.133Z","orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg"},"references":[{"name":"url","tags":["third-party-advisory"],"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json"},{"name":"url","tags":["release-notes"],"url":"https://forums.plex.tv/t/plex-media-server/30447/711"},{"name":"url","tags":["vdb-entry"],"url":"https://www.cve.org/CVERecord?id=CVE-2026-96655"},{"name":"url","tags":["third-party-advisory"],"url":"https://zmain.info/blog/plex2shell"}],"title":"Plex Media Server arbitrary-host SSRF"}},"cveMetadata":{"assignerOrgId":"9119a7d8-5eab-497f-8521-727c672e3725","assignerShortName":"cisa-cg","cveId":"CVE-2026-96655","datePublished":"2026-09-23T16:06:53.133Z","dateReserved":"2026-09-23T14:42:25.245Z","dateUpdated":"2026-10-21T03:56:24.883Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794522003,"cve":"CVE-2026-96655","description":"Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.","epss":{"date":"2026-11-12","epss":0.10724,"percentile":0.95884},"epss_checked":1794522003,"first_seen":1793665374,"kev":{"cveID":"CVE-2026-96655","cwes":["CWE-918"],"dateAdded":"2026-10-20","dueDate":"2026-11-03","forensicTriage":"No","knownRansomwareCampaignUse":"Unknown","notes":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-96655","product":"Media Server","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","shortDescription":"Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.","vendorProject":"Plex","vulnerabilityName":"Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability"},"kev_checked":1794522003,"products":"Plex Media Server","references":["https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json","https://forums.plex.tv/t/plex-media-server/30447/711","https://www.cve.org/CVERecord?id=CVE-2026-96655","https://zmain.info/blog/plex2shell","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96655"],"score":{"attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":5.3,"baseSeverity":"MEDIUM","privilegesRequired":"LOW","provider":"cisa-cg","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE"},"solutions":"","state":"PUBLISHED","title":"Plex Media Server arbitrary-host SSRF","updated_at":1794500401,"url":"https://www.clawpit.io/egret/cves/CVE-2026-96655","workarounds":""},{"affected":[{"defaultStatus":"unknown","product":"Media Server","vendor":"Plex","versions":[{"lessThan":"1.43.3.10861","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"1.43.3.10861"}]}],"cna":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-96654","options":[{"Exploitation":"active"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-20T00:00:00+00:00","version":"2.0.3"},"type":"ssvc"}},{"other":{"content":{"dateAdded":"2026-10-20","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96654"},"type":"kev"}}],"providerMetadata":{"dateUpdated":"2026-10-21T03:56:25.683Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96654"}],"timeline":[{"lang":"en","time":"2026-10-20T00:00:00.000Z","value":"CVE-2026-96654 added to CISA KEV"}],"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unknown","product":"Media Server","vendor":"Plex","versions":[{"lessThan":"1.43.3.10861","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"1.43.3.10861"}]}],"credits":[{"lang":"en","value":"Zach Main"}],"datePublic":"2026-08-03T00:00:00.000Z","descriptions":[{"lang":"en","value":"Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters."}],"metrics":[{"cvssV4_0":{"attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":6.9,"baseSeverity":"MEDIUM","privilegesRequired":"NONE","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"}},{"other":{"content":{"id":"CVE-2026-96654","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-20T15:58:41.367540Z","version":"2.0.3"},"type":"ssvc"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-84","description":"CWE-84 Improper Neutralization of Encoded URI Schemes in a Web Page","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-20T16:46:16.219Z","orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg"},"references":[{"name":"url","tags":["vdb-entry"],"url":"https://www.cve.org/CVERecord?id=CVE-2026-96654"},{"name":"url","tags":["release-notes"],"url":"https://forums.plex.tv/t/plex-media-server/30447/711"},{"name":"url","tags":["third-party-advisory"],"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json"},{"name":"url","tags":["third-party-advisory"],"url":"https://zmain.info/blog/plex2shell"}],"title":"Plex Media Server URL injection"}},"cveMetadata":{"assignerOrgId":"9119a7d8-5eab-497f-8521-727c672e3725","assignerShortName":"cisa-cg","cveId":"CVE-2026-96654","datePublished":"2026-09-23T16:06:35.821Z","dateReserved":"2026-09-23T14:42:18.475Z","dateUpdated":"2026-10-21T03:56:25.683Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794522003,"cve":"CVE-2026-96654","description":"Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.","epss":{"date":"2026-11-12","epss":0.01949,"percentile":0.80515},"epss_checked":1794522003,"first_seen":1793665374,"kev":{"cveID":"CVE-2026-96654","cwes":["CWE-84"],"dateAdded":"2026-10-20","dueDate":"2026-10-23","forensicTriage":"No","knownRansomwareCampaignUse":"Unknown","notes":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-96654","product":"Media Server","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","shortDescription":"Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.","vendorProject":"Plex","vulnerabilityName":"Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability"},"kev_checked":1794522003,"products":"Plex Media Server","references":["https://www.cve.org/CVERecord?id=CVE-2026-96654","https://forums.plex.tv/t/plex-media-server/30447/711","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json","https://zmain.info/blog/plex2shell","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96654"],"score":{"attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":6.9,"baseSeverity":"MEDIUM","privilegesRequired":"NONE","provider":"cisa-cg","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW"},"solutions":"","state":"PUBLISHED","title":"Plex Media Server URL injection","updated_at":1794500401,"url":"https://www.clawpit.io/egret/cves/CVE-2026-96654","workarounds":""}],"pagination":{"limit":25,"next":"https://www.clawpit.io/api/v1/cves.json?page=2&limit=25","page":1,"pages":90,"total":2228}}