hivex CVE-2026-120740

Exploitation requires an application built on hivex to parse an attacker-supplied Windows registry hive file in which registry values contain malformed large data block lists; that malformed structure is the specific trigger named in the description. Limiting factors: a victim must be induced to process the malicious file (user/application interaction), the outcome is limited to a process crash (availability only - no code execution, write, or confidentiality impact per the metrics), and there is no indication of remote network-triggered exploitation despite the supplied AV:N metric.

This is a low-priority issue across every available signal, consistent with the input Decision label 'monitor'. The input CVSS base score is 2.0 and the impact is confined to availability (C:N/I:N/A:L) - an out-of-bounds read (CWE-125) that crashes the parsing process, i.e. a Denial of Service with no code execution or data disclosure. There is no CISA KEV listing, no EPSS value supplied, and no PoC or exploit reference in the input (the two references are a Red Hat CVE page and a Red Hat Bugzilla entry, not exploit code), so exploitation status is 'no public exploit identified at time of analysis'. One signal is internally inconsistent and should be verified: the supplied vector is AV:N/AC:H/PR:H/UI:R, yet the described mechanism is a victim application parsing an attacker-supplied crafted registry hive file, which is a local file-processing vector that would not normally require network access or high privileges - the AV:N/PR:H combination appears mismatched to the description and should be verified with the vendor. Net: a genuine but minor DoS in a parsing library, not an emergency.

An attacker crafts a malformed Windows registry hive file whose registry values contain corrupted large data block lists, then induces a victim system or service that uses hivex (e.g. a virtualization or forensics tool) to parse it. When hivex reads past the bounds of the block list, the processing application crashes, denying service. No public exploit code is identified in the provided sources.