libstoragemgmt CVE-2026-93433

Exploitation requires that the attacker control a local or virtual storage device (physical, USB, iSCSI, or hypervisor-presented disk) that a libstoragemgmt-using process on the host enumerates, and that the host actually queries the device's serial number, triggering _sg_parse_vpd_80() to parse an attacker-supplied SCSI VPD page 0x80 with a malformed page-length field. Limiting factors: the vector is local (AV:L) and needs low privileges plus device-attachment capability (PR:L), so it is not remotely reachable over a network; impact is confined to a process crash/denial of service with no confidentiality or integrity effect; and it is realistically relevant only where hosts enumerate untrusted or attacker-attachable storage, such as multi-tenant virtualization or environments accepting hostile removable/network-attached devices.

This is a genuine but low-priority DoS. The vendor CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) is internally consistent with the description: local attack vector, low complexity, and low privileges reflect that the attacker must already control a local or virtual storage device that the host queries. Impact is availability-only (A:H, with C:N/I:N) - a stack buffer overflow in _sg_parse_vpd_80() during SCSI VPD page 0x80 serial-number parsing that crashes or destabilizes the querying process. Despite being a stack buffer overflow (CWE-121), the vendor scopes impact strictly to denial of service, not code execution, so the A:H-only rating is credible rather than optimistic. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data - all three key exploitation signals are absent, consistent with a recently disclosed, locally-gated bug. There is no signal conflict here: every source points to a low-to-moderate, locally-exploitable availability issue. Real-world priority is modest; patch on normal maintenance cadence unless the host processes VPD data from untrusted or attacker-attachable storage (e.g., multi-tenant virtualization or hostile USB/iSCSI targets).

In a virtualization or multi-tenant environment, an attacker who controls a virtual or physical storage device that the host enumerates crafts a malicious SCSI VPD page 0x80 response with an oversized/untrusted page-length field. When libstoragemgmt on the host queries the device's serial number, _sg_parse_vpd_80() overflows a stack buffer and the querying process crashes. No public exploit code is identified at time of analysis, and exploitation requires local privileges plus attacker control over the storage device.