What is the CVSS score of CVE-2026-33851?

CVE-2026-33851 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Doslib are affected by CVE-2026-33851?

A buffer overflow vulnerability in doslib poses a risk to organizations using this MS-DOS development library, potentially allowing attackers to execute arbitrary code if a user processes a malicious…. A patch is available.

How to fix or mitigate CVE-2026-33851?

Within 24 hours: Identify all systems and development environments using doslib and assess exposure; notify affected teams to avoid processing untrusted files. Within 7 days: Test vendor patch (doslib-20250729 or later) in non-production environments and begin rollout to development systems. Within 30 days: Complete patch deployment across all affected systems and verify no legacy versions remain in use.

Doslib CVE-2026-33851

EUVD-2026-14754 HIGH

Buffer Overflow (CWE-119)

2026-03-24 GovTech CSG

Buffer Overflow Doslib

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 24, 2026 - 06:15 euvd

EUVD-2026-14754

Analysis Generated

Mar 24, 2026 - 06:15 vuln.today

Patch released

Mar 24, 2026 - 06:15 nvd

Patch available

CVE Published

Mar 24, 2026 - 05:48 nvd

HIGH 7.8

DescriptionCVE.org

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in joncampbell123 doslib.This issue affects doslib: before doslib-20250729.

AnalysisAI

Buffer overflow in doslib versions prior to 20250729 allows local attackers with user interaction to achieve full system compromise including code execution, data theft, and denial of service. The vulnerability requires local access and user interaction to trigger, but once exploited grants complete control over affected systems.

Technical ContextAI

Doslib is a development library by joncampbell123 for creating MS-DOS applications and tools. The affected component is identified via CPE cpe:2.3:a:joncampbell123:doslib:*:*:*:*:*:*:*:*. The vulnerability is rooted in CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), a class of flaws where software performs operations on a memory buffer but can read from or write to a memory location outside the intended boundary. This classic memory safety issue can lead to crashes, data corruption, or arbitrary code execution when an attacker can control the out-of-bounds access.

RemediationAI

Upgrade doslib to version doslib-20250729 or later, which contains the fix for this buffer overflow vulnerability. The patch is available via GitHub pull request at https://github.com/joncampbell123/doslib/pull/65. Organizations using doslib in their development environments should update their toolchains to the patched version. Until patching is completed, exercise caution when processing untrusted input files or data with doslib-based tools, and consider restricting the use of vulnerable versions to trusted data sources only in isolated development environments.