What is the CVSS score of CVE-2026-10722?

CVE-2026-10722 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-10722?

Yes, a public proof-of-concept exploit is available for CVE-2026-10722. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for CVE-2026-10722?

Yes, a patch is available for CVE-2026-10722. Update the affected software to the latest version immediately.

cilium ebpf CVE-2026-10722

EUVD-2026-34082 LOW

Integer Overflow or Wraparound (CWE-190)

2026-06-03 VulDB

GHSA-xhgw-qwwf-pg32

Information Disclosure Integer Overflow Cilium Ebpf

1.9

CVSS 4.0 · Vendor: VulDB

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Gain local authenticated shell access
Delivery

Craft malicious BTF blob with overflowing header field values
Exploit

Pass crafted input to LoadCollectionSpec or LoadCollectionSpecFromReader
Execution

Trigger integer overflow in loadRawSpec bounds check
Persist

Bypass buffer validation
Impact

Crash affected process (DoS)

Vulnerability Assessment

Weakness	CWE CWE-190 ASVS 5.0 V15 - Secure Coding and Architecture Integer overflow checks MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires local authenticated access with at minimum low-privilege credentials on the target system (PR:L, AV:L per CVSS vector). The attacker must be able to supply or influence the BTF data processed by LoadCollectionSpec or LoadCollectionSpecFromReader - specifically, they must control header fields StringOff, StringLen, TypeOff, or TypeLen within a crafted BTF blob or eBPF ELF object. Remote exploitation is not possible under any known configuration. Exploitation is limited to causing an availability impact (application crash/DoS) and cannot achieve code execution, data exfiltration, or privilege escalation based on available impact scores (C:N/I:N/A:L). Applications that only load internally compiled, trusted eBPF programs are not realistically exploitable even if running a vulnerable library version.
Impact	CVSS 3.3 (Low) accurately reflects the constrained threat model: AV:L requires physical or shell-level local access, PR:L confirms a low-privileged authenticated user is required, and the impact is limited to A:L (partial availability degradation) with no confidentiality or integrity consequences (C:N/I:N). EPSS data was not provided in the available intelligence, so exploitation probability cannot be quantified numerically. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread active exploitation. However, CVSS temporal components E:P (proof-of-concept exists) and RL:O (official fix available) and RC:C (confirmed) are all set, indicating the vulnerability is real and the POC is public. In practice, this is a low-priority finding for most organizations - exploitation requires local access and yields only a crash/DoS of the application using the library, not code execution or data exfiltration. Organizations running multi-tenant or container-adjacent environments where local users can influence BTF data passed to these APIs should treat this as a moderate operational concern and patch on a standard cycle.
Exploit ScenarioDerived	A local user with standard authenticated access to a developer workstation or container host supplies a maliciously crafted eBPF ELF object file with header fields StringOff, StringLen, TypeOff, or TypeLen set to values that overflow signed 32-bit arithmetic when summed. When an application calls LoadCollectionSpec on this file, the integer overflow bypasses the buffer bounds check in loadRawSpec, causing an out-of-bounds read and crashing the process. A proof-of-concept demonstrating this behavior is publicly available at https://gist.github.com/thesmartshadow/256bff0f8042c584f993ace89074a815.

Monitor Track and reassess. Why: LOW severity (CVSS 0.1-3.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 03, 2026

Integer overflow in the cilium/ebpf Go library (versions up to 0.21.0) allows a local authenticated user to cause an availability impact by supplying crafted BPF Type Format (BTF) data to the LoadCollectionSpec or LoadCollectionSpecFromReader APIs. The flaw resides in the loadRawSpec function where 32-bit header field arithmetic was performed using signed int types, enabling overflow to bypass bounds checks on StringOff, StringLen, TypeOff, and TypeLen fields. No public exploit identified at time of analysis as a KEV listing, though publicly available exploit code exists per VulDB and the CVSS temporal component E:P confirms a proof-of-concept is circulating.

RemediationAI

Apply the upstream fix by updating the cilium/ebpf dependency to a version that includes commit 533dfc82fd228bfadf42ea7180c39de7d9af47fa, available via PR #2021 at https://github.com/cilium/ebpf/pull/2021. The exact patched release version tag is not independently confirmed from available data - verify by checking the cilium/ebpf releases page and confirming the commit is included before pinning a version. As a compensating control where patching is immediately impractical, restrict the ability of untrusted or low-privileged local users to supply external BTF data to any application that calls LoadCollectionSpec or LoadCollectionSpecFromReader; applications consuming only internally-generated, trusted BTF objects have significantly reduced exposure. There are no known side effects of applying the uint64 cast fix, as it only tightens bounds validation logic.

Affected VersionsENISA

ebpf 0.21.0

ebpf 0.3

ebpf 0.18

ebpf 0.11

ebpf 0.19

ebpf 0.20

ebpf 0.2

ebpf 0.9

ebpf 0.14

ebpf 0.12

ebpf 0.7

ebpf 0.13

ebpf 0.15

ebpf 0.17

ebpf 0.5

ebpf 0.4

ebpf 0.10

ebpf 0.6

ebpf 0.1

ebpf 0.16

ebpf 0.8

Affected Packages

go github.com/cilium/ebpf fix: 0.22.0

euvd ebpf no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in go, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The affected code is in btf/btf.go within the cilium/ebpf Go library, a widely-used package for writing eBPF programs from Go. BTF (BPF Type Format) is a kernel metadata format describing types and debug information for eBPF programs, parsed when loading ELF-based eBPF object files. The root cause (CWE-190: Integer Overflow or Wraparound) is the use of signed int arithmetic when summing 32-bit header fields StringOff+StringLen and TypeOff+TypeLen against the buffer length. On architectures where int is 32 bits, or when the sum wraps, the comparison against the buffer length becomes invalid, bypassing memory bounds checks. The patch (PR #2021, commit 533dfc82) resolves this by casting all operands to uint64 before addition, preventing wraparound. Additional fixes in btf/btf_types.go add a length check against the parsed header remainder, and btf/strings.go adds a null-termination check to prevent unbounded string reads. CPE: cpe:2.3:a:cilium:ebpf:*:*:*:*:*:*:*:*.

Know when Cilium gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulDB) PRIMARY 1.9 LOW

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Local

Attack Complexity

Low

Attack Requirements

None

Privileges Required

Low

User Interaction

None

Vulnerable system: Confidentiality

None

Vulnerable system: Integrity

None

Vulnerable system: Availability

Low

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

CVSS changed

Jun 03, 2026 - 13:22 NVD

3.3 (LOW) 1.9 (LOW)

DescriptionCVE.org

A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go of the component LoadCollectionSpec/LoadCollectionSpecFromReader. Such manipulation leads to integer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The name of the patch is 533dfc82fd228bfadf42ea7180c39de7d9af47fa. A patch should be applied to remediate this issue.

Threat Intelligence Overview

EPSS Score

0.0%

Top 98% exploitable

Exploit

POC

Public exploit code exists

Data Quality

8 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment MSRC CIRCL

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity LOW

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

LOW severity (CVSS 0.1-3.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation

Poc

System Exposure· derived

Small

Automatable

Human Impact· derived

Low

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +10

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Integer Overflow MEDIUM

Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.