EUVD-2026-52694
GHSA-pr84-483f-rmg2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed VirtualServer endpoint
-
DeliveryCraft valid protobuf message with missing required field
-
ExploitSend to dispatcher over network
-
ExecutionDispatcher calls unwrap() on None value
-
PersistRust panic triggers SIGABRT
-
ImpactServer process aborts, service unavailable
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V5 - File Handling Incomplete identification of uploaded file
|
| Exploitation Conditions | The Perspective VirtualServer protocol dispatcher must be reachable over the network by the attacker. No authentication is required - the CVSS 4.0 vector confirms PR:N. No special configuration is needed beyond having the VirtualServer component running, which is part of Perspective's standard server-mode operation. The attacker must be able to send raw protobuf messages to the dispatcher endpoint; well-formed but deliberately incomplete messages (e.g., ViewToArrowReq with no viewport field, MakeTableReq with no data field) are sufficient to trigger each of the nine crash sites. Exploitation is limited to availability impact only - there is no evidence of memory corruption enabling code execution, and no confidentiality or integrity impact is claimed. The primary limiting factor is network reachability: deployments that expose the VirtualServer only to internal, trusted networks significantly reduce realistic attacker population. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, score 8.7) accurately reflects the severity: unauthenticated, low-complexity, network-accessible exploitation with total availability impact. No EPSS score is available in the provided data, making probabilistic exploitation likelihood assessment impossible from this dataset. There is no CISA KEV listing, so active exploitation in the wild is not confirmed. However, a public proof-of-concept exists and the attack technique is trivial - send a well-formed but field-incomplete protobuf message - requiring no specialized tooling or target-specific reconnaissance. The presence of nine independent crash sites makes partial patching a plausible outcome, as missing even one site leaves the vulnerability exposed. Real-world risk is high for any deployment that exposes the VirtualServer dispatcher to untrusted network clients; risk drops substantially if the service is internal-only or access-controlled at the network boundary. The impact is purely availability-based with no confidentiality or integrity consequence, limiting the blast radius to service disruption rather than data compromise. |
| Exploit ScenarioDerived | An attacker with network access to a Perspective VirtualServer endpoint crafts a ViewToArrowReq protobuf message that omits the required viewport field and transmits it to the dispatcher. The dispatcher processes the structurally valid message, attempts to unwrap the absent viewport Option, and triggers an immediate Rust panic that terminates the server process with SIGABRT, taking down the analytics service for all users. A public blog post at christbowel.com demonstrates this and eight additional crash variants, providing ready-made proof-of-concept payloads. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 04, 2026
Unauthenticated remote denial-of-service in Perspective 5.0.0 crashes the server process by exploiting missing field validation in the VirtualServer protocol dispatcher. Attackers send syntactically valid but semantically incomplete protobuf messages - such as ViewToArrowReq without a viewport or MakeTableReq without a data field - triggering Rust unwrap() calls on None values at nine distinct code sites, each causing an immediate SIGABRT process abort. No public exploit is confirmed actively exploited (no CISA KEV listing), but a publicly available proof-of-concept exists via a researcher blog post, and the attack requires no authentication against a network-accessible endpoint.
RemediationAI
No specific patched release version is identified in the available data; upstream fix availability should be confirmed by monitoring the perspective-dev GitHub repository and the VulnCheck advisory at https://www.vulncheck.com/advisories/perspective-dos-via-virtualserver-protocol-dispatcher. Until a patched version is confirmed released, deployments should restrict network access to the VirtualServer dispatcher endpoint using firewall rules or network-level ACLs to permit only trusted client IP ranges - this eliminates the unauthenticated remote attack surface with no functional impact to authorized users. As a secondary control, deploying a reverse proxy or API gateway that validates protobuf message field completeness before forwarding to the VirtualServer can prevent malformed messages from reaching the vulnerable dispatcher; note this requires protobuf-aware inspection capability. If the VirtualServer component is not actively used, disabling it entirely removes the attack surface without affecting other Perspective functionality. Organizations should track the nine distinct crash sites documented in the researcher's disclosure to verify that a future patch addresses all of them.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Perspective is an open-source high-performance streaming data visualization and analytics library maintained under the perspective-dev organization (CPE: cpe:2.3:a:perspective-dev:perspective:*:*:*:*:*:*:*:*). The VirtualServer component exposes a request dispatcher that accepts Google Protocol Buffer (protobuf) encoded messages from remote clients to perform operations such as viewport management and table construction. The server-side dispatcher is implemented in Rust and relies on Option::unwrap() to extract expected fields from incoming messages. When a client omits required fields, the dispatcher calls unwrap() on a None value rather than handling the absent field gracefully, immediately triggering a Rust panic that the runtime escalates to SIGABRT, killing the server process. The listed CWE is CWE-616, though this maps more precisely to CWE-252 (Unchecked Return Value) or CWE-476 (NULL Pointer Dereference analog in Rust), as the root cause is the absence of defensive Option handling before unwrapping. Nine distinct crash-triggering call sites were identified, indicating a systemic pattern of missing input validation rather than an isolated bug.
Know when Perspective gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network-accessible, no auth required, no user interaction; impact is total availability loss of server process with no confidentiality or integrity consequence and no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Perspective 5.0.0 contains a denial-of-service vulnerability in the VirtualServer protocol dispatcher that allows unauthenticated remote attackers to crash the server process by sending malformed or incomplete protobuf messages. Attackers can send well-formed requests such as ViewToArrowReq with no viewport set or MakeTableReq with no data field to trigger unwrap() calls on None values at nine distinct sites, causing the process to abort with SIGABRT.
Executive ViewAI
Perspective 5.0.0 contains an unauthenticated remote denial-of-service vulnerability (CVE-2026-67198) that crashes the server process, directly impacting availability for any organization operating this version on network-accessible systems. With publicly available exploit code existing, this vulnerability presents an immediate and trivial exploitation risk requiring no credentials.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to the VirtualServer protocol endpoint via firewall ACLs or network segmentation, implement rate limiting on incoming connections, deploy intrusion detection rules for malformed protobuf messages on this service, and maintain audit logging of connection attempts to detect exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Perspective
View allPerspective ICM Investigation & Case 5.1.1.16 allows remote authenticated users to modify access level permissions and c
Remote code execution in Perspective 5.0.0 exposes any network-reachable PolarsVirtualServer backend to arbitrary OS com
Remote unauthenticated file disclosure in perspective-dev/perspective 5.0.0 allows any network attacker to read arbitrar
Denial of service in Perspective 5.0.0 allows low-privileged remote attackers to render the server permanently unrespons
Cross-site scripting in Perspective 5.0.0's built-in Debug plugin enables an authenticated attacker with low privileges
Exploit-DB