EUVD-2026-42243
GHSA-4cxm-m972-4x2h
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated remote trigger (AV:N/AC:L/PR:N/UI:N) with availability-only impact from a DoS integer overflow, so C:N/I:N/A:H and scope unchanged.
Primary rating from Vendor (emc).
CVSS VectorVendor: emc
Lifecycle Timeline
2DescriptionCVE.org
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an Integer overflow or wraparound vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service.
AnalysisAI
Denial of service in Dell PowerProtect Data Domain (DDOS versions 7.7.1.0 through 8.7, plus LTS2026 8.6.1.0-8.6.1.10, LTS2025 8.3.1.0-8.3.1.30, and LTS2024 7.13.1.0-7.13.1.70) allows a remote, unauthenticated attacker to crash or hang the appliance by triggering an integer overflow (CWE-190). Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is required, and the impact is confined to availability (C:N/I:N/A:H) - no data disclosure or code execution. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; EPSS was not provided.
Technical ContextAI
PowerProtect Data Domain (formerly EMC Data Domain, running the DDOS operating environment) is Dell's purpose-built backup appliance line providing deduplicated protection storage, replication, and DD Boost integration for enterprise backup workflows. The root cause is CWE-190, an integer overflow or wraparound, in which an arithmetic operation on an attacker-influenced value exceeds the storage width of its integer type and wraps to an unexpected value. In network-facing code this typically corrupts a length or size calculation used for buffer allocation or bounds checking, and here the resulting condition manifests as a crash or resource exhaustion rather than memory corruption leading to code execution, consistent with the availability-only impact. The specific network service or protocol parser affected is not disclosed in the available data; Dell advisory DSA-2026-278 covers multiple vulnerabilities, so the exact component is not pinned down here.
RemediationAI
Upgrade DDOS to a Dell-fixed release per advisory DSA-2026-278 (https://www.dell.com/support/kbdoc/en-us/000481268/dsa-2026-278-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities); the input does not enumerate exact patched build numbers, so consult that advisory for the fixed version corresponding to your branch (mainline, LTS2026, LTS2025, or LTS2024) rather than relying on an assumed number. Because no exact fix version was supplied here, treat patch status as 'Patch available per vendor advisory' and confirm the target build against Dell before scheduling. As compensating controls until patched, restrict network reachability of the appliance's management and data-service interfaces to trusted backup/management VLANs and administrative jump hosts via firewall/ACLs, and block access from user and internet-facing segments - the trade-off is that legitimate backup clients, replication peers, and DD Boost sources must remain explicitly permitted, so scope allowlists to known peers to avoid breaking backup jobs. Ensure appliance monitoring/alerting is in place so an availability outage from a crash is detected and the service can be restarted quickly.
More in Data Domain Operating System
View allDell PowerProtect Data Domain with Data Domain Operating System (DD OS) versions prior to 8.3.0.15 contain an Insufficie
Improper authorization enforcement in Dell PowerProtect Data Domain (versions 7.7.1.0 through 8.6, plus LTS branches 8.6
Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an OS command injection v
Dell PowerProtect DD, version(s) 8.0, 7.13.1.0, 7.10.1.30, 7.7.5.40, contain(s) an Out-of-bounds Write vulnerability. Ra
Dell PowerProtect Data Domain, versions prior to 8.1.0.0, 7.13.1.10, 7.10.1.40, and 7.7.5.50, contains an escalation of
Dell PowerProtect DD, versions prior to 8.1.0.0, 7.13.1.10, 7.10.1.40, and 7.7.5.50, contains an access control vulnerab
Stored cross-site scripting in Dell PowerProtect Data Domain (DD OS 7.7.1.0 through 8.7, plus the LTS2026 8.6.1.x, LTS20
Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 on DDMC contain a relative path t
OS command injection in Dell PowerProtect Data Domain enables a high-privileged local attacker to execute arbitrary oper
OS command injection in Dell PowerProtect Data Domain across four version release trains allows a high-privileged remote
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.
Dell PowerProtect DD, versions prior to 7.7.5.50, contains an Exposure of Sensitive Information to an Unauthorized Actor
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today