EUVD-2026-70244Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Loading eBPF is a local, privilege-gated action (AV:L, PR:L); verifier bypass crosses into the kernel/host execution context (S:C) enabling memory-corruption C/I/A:H.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, in the Prevail eBPF verifier, EbpfTransformer::add() silently skips offset-variable updates when the destination register carries a non-singleton typeset (two or more simultaneously possible pointer types). Subsequent bounds checks use the stale offset and accept out-of-bounds memory accesses, so a crafted BPF program passes verification even though it would corrupt memory at runtime. This issue has been patched in version 0.2.4.
AnalysisAI
Verifier bypass in PREVAIL, the polynomial-runtime eBPF verifier (used notably as the abstract-interpretation verifier in ebpf-for-windows), affects all versions prior to 0.2.4. When a destination register carries a non-singleton typeset - two or more simultaneously possible pointer types, e.g. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the ability to submit a crafted eBPF program to a system that uses a pre-0.2.4 PREVAIL as its verifier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a soundness break in a security-critical component: an eBPF verifier's entire purpose is to prove that untrusted bytecode cannot corrupt memory, so a verification bypass that admits out-of-bounds kernel/host memory accesses is high-severity by nature. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to PREVAIL 0.2.4, which invalidates (havocs) all pointer offset variables when a destination register has a non-singleton or union typeset instead of leaving stale offsets - Vendor-released patch: v0.2.4 (release https://github.com/vbpf/prevail/releases/tag/v0.2.4, commit 2b209bc4e3d612ff9aca87125e67c0ff84477e61, advisory GHSA-2qc8-qh94-66rc). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all systems running ebpf-for-windows and determine deployed versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Verifier bypass in PREVAIL (vbpf/prevail), the polynomial-runtime eBPF static verifier, before version 0.2.4 lets an att
Verification bypass in prevail eBPF verifier versions before 0.2.4 allows any caller with eBPF program submission access
Same weakness CWE-682 – Incorrect Calculation
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today