EUVD-2026-41538
GHSA-m8g3-j6vx-2gv9
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Local access with low privileges required per description; only partial confidentiality impact from uninitialized memory read; no integrity or availability impact; scope unchanged.
Primary rating from Vendor (emc).
CVSS VectorVendor: emc
Lifecycle Timeline
2DescriptionCVE.org
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an use of uninitialized resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure.
AnalysisAI
Information exposure in Dell PowerProtect Data Domain across multiple release tracks allows a low-privileged local attacker to read sensitive residual data via an uninitialized memory resource (CWE-908). The flaw spans the mainline 7.7.1.0-8.7 branch and three LTS tracks (LTS2024, LTS2025, LTS2026), confirmed by Dell via advisory DSA-2026-278. No public exploit code exists and no active exploitation has been identified; the CVSS 3.3 score and local-only attack vector place this firmly in the low-severity tier.
Technical ContextAI
CWE-908 (Use of Uninitialized Resource) describes a class of defect where software reads from a memory buffer, variable, or data structure before assigning it a valid value, potentially exposing residual contents from prior operations. Dell PowerProtect Data Domain is a purpose-built backup and deduplication appliance widely deployed as a protection storage target. The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N confirms the flaw is exercisable only from a local session with at least low-level privileges, results in limited confidentiality impact only, and does not cross a trust boundary (S:U). No CPE strings were provided in the input, but the affected product family is unambiguously identified by Dell's own disclosure as PowerProtect Data Domain across mainline and LTS release tracks.
RemediationAI
Consult Dell advisory DSA-2026-278 at https://www.dell.com/support/kbdoc/en-us/000481268/dsa-2026-278-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities for the specific fixed versions applicable to each release track. Exact patched version numbers were not included in the available input data and must be confirmed directly from the advisory before planning upgrades. As a compensating control where patching is deferred, restrict local shell and administrative access to the Data Domain appliance strictly to authorized personnel - this directly addresses the PR:L local-access prerequisite and eliminates the exploitation surface for untrusted users. Note that this control does not remediate the underlying defect and should not substitute for patching.
More in Data Domain Operating System
View allDell PowerProtect Data Domain with Data Domain Operating System (DD OS) versions prior to 8.3.0.15 contain an Insufficie
Improper authorization enforcement in Dell PowerProtect Data Domain (versions 7.7.1.0 through 8.6, plus LTS branches 8.6
Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an OS command injection v
Dell PowerProtect DD, version(s) 8.0, 7.13.1.0, 7.10.1.30, 7.7.5.40, contain(s) an Out-of-bounds Write vulnerability. Ra
Denial of service in Dell PowerProtect Data Domain (DDOS versions 7.7.1.0 through 8.7, plus LTS2026 8.6.1.0-8.6.1.10, LT
Dell PowerProtect Data Domain, versions prior to 8.1.0.0, 7.13.1.10, 7.10.1.40, and 7.7.5.50, contains an escalation of
Dell PowerProtect DD, versions prior to 8.1.0.0, 7.13.1.10, 7.10.1.40, and 7.7.5.50, contains an access control vulnerab
Stored cross-site scripting in Dell PowerProtect Data Domain (DD OS 7.7.1.0 through 8.7, plus the LTS2026 8.6.1.x, LTS20
Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 on DDMC contain a relative path t
OS command injection in Dell PowerProtect Data Domain enables a high-privileged local attacker to execute arbitrary oper
OS command injection in Dell PowerProtect Data Domain across four version release trains allows a high-privileged remote
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.
Same weakness CWE-908 – Use of Uninitialized Resource
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today