How to fix or mitigate CVE-2026-42958?

Within 24 hours: Inventory all systems running the affected ICS/OT application and classify by business criticality. Within 7 days: Apply file-level access restrictions limiting who can open external files, disable the application on non-critical systems if feasible, and conduct user security awareness training regarding file-based exploitation risks. Within 30 days: Establish a contingency plan with the vendor for patch availability, evaluate alternative software solutions, and implement network segmentation to isolate affected systems from less-trusted networks.

CVE-2026-42958

Q: What is the CVSS score of CVE-2026-42958?

CVE-2026-42958 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-42121 HIGH

Use After Free (CWE-416)

2026-07-07 ics-cert@hq.dhs.gov

GHSA-38rj-c63j-q99w

RCE Buffer Overflow Use After Free Memory Corruption

8.4

CVSS 4.0 · Vendor: hq

Severity by source

Vendor (hq) PRIMARY

8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (hq) · only source for this CVE.

CVSS VectorVendor: hq

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 07, 2026 - 22:32 vuln.today

DescriptionCVE.org

The application contains a use-after-free vulnerability that can be exploited to cause memory corruption while parsing specially crafted files. This could allow an attacker to execute arbitrary code in the context of the current process.

AnalysisAI

Arbitrary code execution in an unnamed ICS/OT application arises from a use-after-free (CWE-416) triggered when the software parses a specially crafted file, letting an attacker run code in the context of the current process. The flaw was reported through CISA's ICS-CERT (advisory ICSA-26-188-06) and carries a CVSS 4.0 base score of 8.4; exploitation is local and requires a user to open the malicious file. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV.