EUVD-2026-54792
GHSA-h29x-j2gq-hpv4
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Provided vector is consistent with CWE-131 file-parsing pattern; AV:L and UI:R reflect file-delivery scenario, PR:N aligns with no privilege needed to open a file.
Primary rating from Vendor (vendor:ubuntu).
CVSS VectorVendor: vendor:ubuntu
Lifecycle Timeline
4DescriptionCVE.org
[Unknown description]
AnalysisAI
Incorrect buffer size calculation (CWE-131) in an unidentified Linux distribution package tracked by both Ubuntu and Red Hat enables local, user-interaction-triggered exploitation with high confidentiality, integrity, and availability impact, yielding a CVSS base score of 7.8. The local attack vector combined with a user-interaction requirement (AV:L/UI:R/PR:N) is consistent with a malicious file parsing scenario, where a user opens a crafted input triggering the buffer miscalculation. No public exploit has been identified at time of analysis, and no KEV listing is present; however, the full C:H/I:H/A:H impact triad indicates potential for memory corruption leading to arbitrary code execution.
Technical ContextAI
CWE-131 (Incorrect Calculation of Buffer Size) describes a root cause where a program computes an allocation size incorrectly - typically by omitting a null terminator, using the wrong data type width, or failing to account for encoding overhead - resulting in an undersized buffer. When subsequent write operations fill this buffer, adjacent memory regions are corrupted, enabling heap or stack overflow conditions that attackers can leverage for code execution or denial of service. The CVSS vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H is structurally consistent with a file-parsing library or application where an unprivileged user opens a crafted file, triggering the miscalculation without requiring any elevated system privileges. The package is tracked by both Ubuntu (reporter) and Red Hat (reference advisory at access.redhat.com and Bugzilla ID 2461726), suggesting it is a shared open-source library or utility present in both Debian-family and RPM-family distributions. The specific CPE string was not provided, preventing precise version-range identification.
RemediationAI
Because the CVE description is unavailable and no explicit patch version was provided in the input data, a specific upgrade target cannot be stated with confidence. The primary remediation action is to consult the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-42170 and Red Hat Bugzilla entry https://bugzilla.redhat.com/show_bug.cgi?id=2461726 to identify the patched package version, then apply the vendor-released update via the distribution package manager (dnf update or apt-get upgrade for the affected package). For Ubuntu systems, check the Ubuntu Security Notices portal for a corresponding USN advisory. As a compensating control pending patch availability, restricting user access to untrusted input files processed by the affected software reduces exposure - specifically, avoid opening files from untrusted sources with the vulnerable application. The trade-off is operational friction for legitimate file processing workflows. No patch version has been independently confirmed from the available input data.
More in Enterprise Linux
View allIn PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.4.4
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected
Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb7
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1
Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.2
Sudo before 1.9.17p1 contains a local root escalation vulnerability (CVE-2025-32463, CVSS 9.3) through the --chroot opti
Same weakness CWE-131 – Incorrect Calculation of Buffer Size
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today