What is the CVSS score of CVE-2026-42199?

CVE-2026-42199 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-42199?

Yes, a patch is available for CVE-2026-42199. Update the affected software to the latest version immediately.

Grid CVE-2026-42199

EUVD-2026-28834 MEDIUM

Integer Overflow or Wraparound (CWE-190)

2026-05-08 GitHub_M

Integer Overflow Buffer Overflow Grid

6.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

May 08, 2026 - 23:18 EUVD

CVE Published

May 08, 2026 - 21:15 nvd

MEDIUM 6.2

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 cargo packages depend on grid (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 0.17.0.

DescriptionGitHub Advisory

Grid is a data structure grid for rust. From version 0.17.0 to before version 1.0.1, an integer overflow in Grid::expand_rows() can corrupt the relationship between the grid’s logical dimensions and its backing storage. After the internal invariant is broken, the safe API get() may invoke get_unchecked() with an invalid index, resulting in Undefined Behavior. This issue has been patched in version 1.0.1.