EUVD-2026-106990
GHSA-7rmr-p966-7g82
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local account on host
-
ExploitSend command with trailing '%' to multipathd
-
ExecutionTrigger out-of-bounds read in format handling
-
ImpactLeak daemon memory or crash multipathd
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a local account on a host running device-mapper-multipath where the multipath daemon (multipathd) is active and the attacker can submit commands to its control/command interface - typically systems using multipath storage (SAN/enterprise storage, many RHEL and OpenShift deployments). The trigger is a specific malformed input: a command whose format string ends in a trailing percent ('%') character. Exploitation is limited by the need for local access (no remote/network vector) and by multipathd actually running; systems without multipathing configured are not exposed. Impact is bounded to limited memory disclosure or daemon crash, not code execution or integrity loss. |
| Impact | This is a moderate-severity, locally-exploitable issue rather than a top-tier priority. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L, base 5.1) indicates a local attack vector with low complexity and, notably, no privileges required (PR:N) - meaning any local user who can reach the multipathd command interface can trigger it. Impact is limited: low confidentiality (partial daemon memory disclosure via out-of-bounds read, consistent with CWE-125) and low availability (daemon crash/DoS), with no integrity impact. No EPSS score, CISA KEV listing, POC, or SSVC decision data was supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the realistic risk is a local, likely low-privileged user escalating to limited info-leak or crashing storage multipathing. The signals are internally consistent - the local vector matches the description's 'local user' and daemon command channel - so there is no network-vs-local conflict to flag. Overall this is a defense-in-depth / multi-tenant-host concern, not an urgent internet-facing emergency. |
| Exploit ScenarioDerived | A local user (for example on a shared or multi-tenant RHEL host) sends a crafted command containing a format string ending in a trailing percent character to the multipath daemon's command interface. The malformed format string drives an out-of-bounds read that either leaks adjacent daemon memory back to the user (information disclosure) or crashes multipathd, disrupting storage multipathing (DoS). No public exploit code is identified; given AV:L/AC:L, exploitation is simple but requires an existing local foothold. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
An out-of-bounds read in device-mapper-multipath's multipathd daemon allows local users who can submit commands to the daemon's control interface to read past the end of a buffer by supplying a command whose format string ends in a trailing percent character, exposing unintended daemon memory (limited information disclosure) or crashing multipathd to cause a denial of service. Local attackers need no prior privileges on the host per the CVSS vector (PR:N), but exploitation requires a local account on a system where multipathd is running and reachable. Affected products include Red Hat Enterprise Linux 6, 7, 8, 9 and 10 plus Red Hat OpenShift Container Platform 4, which ships the component in its RHEL-based node stack. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; impact is bounded to confidentiality and availability (5.1, C:L/A:L), with no code execution or integrity impact.
RemediationAI
No vendor-released patch was identified at the time of analysis; Red Hat's CVE record (https://access.redhat.com/security/cve/CVE-2026-114038) and Bugzilla 2469787 should be monitored for the exact fixed device-mapper-multipath package versions per RHEL stream and for the corresponding OpenShift Container Platform 4 errata/RHSA. Until then, the most effective control is to reduce who can talk to the daemon: tighten ownership and permissions on /run/multipathd.sock (root:root, mode 0660 or stricter) and audit membership of any group granted access, since the socket is the sole attack surface and removing non-admin members eliminates the local path without affecting path failover - the trade-off is that legitimate monitoring/admin tooling must run as root. On hosts where multipathing is not actually in use, disable and stop multipathd (systemctl disable --now multipathd) or mask the unit in the initramfs, accepting the loss of automatic path monitoring and failover if a SAN device is later attached. Keep SELinux enforcing with the stock multipathd policy to constrain the daemon, and on OpenShift 4 nodes restrict privileged host access (no routine non-admin host logins, tight debug/oc adm node access) so untrusted users cannot reach the socket. Monitor for multipathd crashes or restart loops as a detection signal, and treat any 'multipath -ll'/'multipathd show' output of unexpected memory contents as evidence of memory disclosure.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
device-mapper-multipath is the userspace component of the Linux kernel device-mapper multipath target: the multipathd daemon monitors SAN/enterprise storage paths, reconfigures maps, and exposes an interactive command interface over a UNIX socket (/run/multipathd.sock, normally reachable by members of the privileged group or root, and via the multipathd client command). Many of those commands accept printf-style format strings containing '%' specifiers. The root cause is CWE-125 (Out-of-bounds Read): when a command's format string ends in a trailing '%', the parser continues reading one byte past the end of the supplied buffer while looking for the conversion specifier. Because multipathd handles such requests in-process, the over-read occurs within daemon address space, so the caller can receive leaked memory contents (limited information disclosure) or the daemon can fault and terminate (denial of service via loss of path monitoring and failover). The CPE data shows the flaw spanning the entire RHEL 6-through-10 lifecycle and OpenShift Container Platform 4, indicating a long-lived parser pattern rather than a regression in a single release; there is no network vector, no privilege requirement in the CVSS vector, and no user interaction.
Know when Red Hat Enterprise Linux 10 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Local user reaches the multipathd command channel with no privileges (AV:L, PR:N, AC:L); out-of-bounds read yields partial memory disclosure (C:L) and a daemon crash (A:L), no integrity impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in device-mapper-multipath. A local user can trigger an out-of-bounds read by sending a command with a format string ending in a trailing percent character to the multipath daemon. This issue can allow the user to expose unintended daemon memory, leading to information disclosure, or cause the daemon to crash, resulting in a Denial of Service (DoS).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to
The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
Exploit-DB