EUVD-2026-111247
GHSA-6gvh-cphr-573v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local low-privileged access to endpoint
-
ExploitTrigger use-after-free in Threat Response CX
-
ImpactDisrupt client extension availability
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local access to a host running the Tanium Threat Response Client Extension and pre-existing low-level privileges on that host (CVSS PR:L), not remote or unauthenticated access. Attack complexity is High (AC:H), indicating conditions beyond the attacker's direct control must be met, though the specific trigger for the use-after-free is not described in the available sources. The only outcome is partial availability loss (A:L) of the client extension - there is no confidentiality or integrity impact - which sharply limits realistic risk. Affected components are the Tanium Threat Response Client Extension and the Endpoint Configuration Toolset Solution; upgrading to the vendor's fixed builds (per Tanium advisory TAN-2026-068) is the remediation, with fixed branches listed across Endpoint Configuration Toolset 1.51/1.59/1.71 and multiple threat-response-cx branches (verify exact build numbers against the vendor advisory, as the EUVD ranges are self-referential). |
| Impact | This is a low-priority issue despite being a memory-corruption class flaw (CWE-416 use-after-free). The CVSS 3.1 base score is 2.5 (Low), and the vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L shows why: exploitation requires local access (AV:L), already-held low privileges (PR:L), and high attack complexity (AC:H), while the only impact is partial availability (A:L) with no confidentiality or integrity impact (C:N/I:N). There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, all of which align with the vuln.today 'monitor' decision label - the lowest actionable tier. No signals conflict in the direction of elevated urgency; every available signal (low CVSS, local+authenticated+high-complexity vector, availability-only impact, vendor self-report, monitor label, absent EPSS/KEV/POC) points to a genuinely low real-world risk. One metadata inconsistency should be noted: the input Tags include 'Information Disclosure', but the CVSS vector sets C:N (no confidentiality impact), so the tag is not supported by the scored impact - treat the availability-only characterization as authoritative and verify with the Tanium advisory if confidentiality is a concern. |
| Exploit ScenarioDerived | A local attacker who already has low-privileged access to an endpoint running the Tanium Threat Response Client Extension triggers the use-after-free condition to crash or disrupt the client extension, causing a partial denial of service on that endpoint. No public exploit code has been identified, and the high attack complexity plus required local authenticated access make opportunistic or remote exploitation impractical. The specific trigger for the use-after-free is not described in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
A use-after-free memory-corruption flaw in the Tanium Threat Response Client Extension requires local access to a host plus pre-existing low-level privileges, and its worst outcome is partial availability loss of the client extension - no confidentiality or integrity impact. Tanium has released fixed builds across the Endpoint Configuration Toolset Solution (1.51, 1.59, 1.71 branches) and multiple threat-response-cx branches per advisory TAN-2026-068. This is a low-priority issue: no public exploit code, PoC reference, or CISA KEV entry is present in the available data, and the priority label is monitor.
RemediationAI
Tanium has released patched builds, so remediation is to upgrade the Threat Response Client Extension and Endpoint Configuration Toolset Solution to the vendor's fixed builds on the branch in use, following advisory TAN-2026-068 at https://security.tanium.com/TAN-2026-068 and verifying the exact fixed build numbers there, since the EUVD ranges are self-referential and the specific fixed versions are not given in the supplied data. Because exploitation requires local access plus pre-existing low-level privileges and only partial availability loss of the client extension results, the update can be scheduled on a normal maintenance cadence rather than treated as an emergency; the priority label for this CVE is monitor. The sources do not describe any workaround, and no compensating control beyond applying the vendor update is stated, so no alternative mitigation can be recommended from the available data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a use-after-free (CWE-416) in the Tanium Threat Response Client Extension, a component that runs on managed endpoints alongside the Endpoint Configuration Toolset Solution (both appear in the affected CPE set). Use-after-free means a heap object is freed while a reference to it remains and is later dereferenced, which typically yields memory corruption; here the assessed outcome is limited to partial availability impact (A:L) with no confidentiality or integrity effect, and severity is modest at CVSS 2.5. The vector (AV:L/AC:H/PR:L/UI:N) shows the flaw is reachable only by a local actor with existing low-level privileges, with high attack complexity indicating conditions beyond the attacker's direct control must be satisfied; the sources do not describe the specific trigger, so the precise sequence that frees the object and the subsequent dereference path remain unverified. Neither the CVE description nor the vendor reference details the vulnerable function or the exact configurations exposed.
Know when Tanium gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
A local, already-privileged user triggers a hard-to-win use-after-free (AV:L/PR:L/AC:H) that only degrades the client extension's availability (A:L), with no confidentiality or integrity impact.
Primary rating from Vendor (Tanium).
CVSS VectorVendor: Tanium
Lifecycle Timeline
1DescriptionCVE.org
Tanium addressed a use-after-free vulnerability in Threat Response Client Extension.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
SQL injection in the Tanium Asset module lets an authenticated, high-privilege user read and modify data in the underlyi
Unauthorized OS command execution in Tanium Connect allows an attacker holding low-privilege authenticated access to run
OS command injection in Tanium Connect lets an authenticated, low-privileged user execute arbitrary commands on the unde
Tanium addressed an improper input validation vulnerability in Deploy. [CVSS 8.8 HIGH]
Command injection in Tanium Certificate Manager allows an authenticated attacker with low-level access to execute unauth
Command injection in Tanium Threat Response allows an authenticated low-privilege attacker to execute unauthorized code
SQL injection in Tanium Threat Response (CVSS 3.1 base score 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) allows a low-priv
Path traversal in Tanium Comply allows authenticated low-privileged network users to read files outside the module's int
Path traversal in Tanium Comply exposes all authenticated low-privilege users to a scope-changing arbitrary file write a
SQL injection in Tanium Comply (CWE-89) allows a network-accessible, unauthenticated attacker - contingent on user inter
Improper access controls (CWE-862, Missing Authorization) in Tanium Comply allow an authenticated low-privileged user to
Improper access controls in Tanium Comply allow an authenticated low-privilege user to perform unauthorized operations w
Exploit-DB