InfiniStore CVE-2026-11312

The attacker must have local access to the system running InfiniStore and a low-privilege OS account (PR:L per CVSS). No special non-default configuration is required - the purge_kv_map function is a core component of the KV Map Handler and is exercised during normal operation. Exploitation is strictly limited to local vectors (AV:L); remote or network-based exploitation is not possible per the CVSS vector. The impact ceiling is low availability degradation (A:L), not full denial of service or data exposure - the CVSS confirms C:N and I:N. Exploitation is further bounded by the requirement for a local shell or process execution context on the InfiniStore host.

Real-world risk is low. The CVSS base score of 3.3 is consistent with the vector components: local attack vector (AV:L), low complexity (AC:L), low privileges required (PR:L), and only a low availability impact (A:L) with no confidentiality or integrity impact. This is not remotely exploitable and requires an authenticated local session on the host running InfiniStore. EPSS data is absent from the provided intelligence, so exploitation probability cannot be quantified statistically. The vulnerability is not listed in the CISA KEV catalog, confirming no observed active exploitation. The E:P temporal modifier confirms publicly available proof-of-concept code (GitHub issue #200), which slightly elevates near-term opportunistic risk. The 'Information Disclosure' tag in the source data conflicts with the CVSS confidentiality impact of C:N - this appears to be a tagging error from VulDB; the actual impact is limited availability degradation only. The RL:X (remediation level not defined) modifier reflects the vendor's lack of response, leaving no official fix timeline.

A locally authenticated user with minimal privileges submits a crafted set of key-value entries designed to trigger worst-case algorithmic behavior in purge_kv_map during a cleanup cycle. The function iterates over the malicious map structure in a computationally expensive pattern, causing the InfiniStore process to consume excessive CPU or stall, resulting in partial service unavailability. A public proof-of-concept demonstrating this behavior exists in GitHub issue #200.