PowerProtect Data Domain EUVD-2026-110814

Exploitation requires an attacker who already possesses high privileges (PR:H) on the Dell PowerProtect Data Domain appliance and has remote/network reach to it; this administrative-level prerequisite is the primary limiting factor and means the flaw is not exploitable by an unauthenticated or low-privileged remote attacker. The description does not name a specific feature, protocol, SAPI, or non-default configuration mode that must be enabled to trigger the stack-based buffer overflow, so the exact trigger is not described in the available sources. Affected deployments are Feature Release 7.7.1.0 through 8.7, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20; the only impact is denial of service (no confidentiality or integrity loss). Per EUVD, fixed versions are 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0, available from Dell - updating is the remediation the vendor provides.

This is a genuinely moderate, low-urgency issue rather than a high-impact priority. The CVSS 3.1 base score is 4.9 (Medium), and every signal points the same direction: the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N shows network reach with low complexity and no user interaction, but it requires high privileges (PR:H), and the only impact is availability (C:N/I:N/A:H) - a denial of service, with no confidentiality or integrity loss. There is no CISA KEV listing, no EPSS score supplied, and no public PoC or exploit reference in the input, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC exploitation/automatable/technical-impact decision values were provided; the only decision signal is the vuln.today priority label 'this_month,' which is consistent with a patch-on-normal-cadence item rather than an emergency. The signals are mutually consistent and non-conflicting: a Medium-severity, availability-only flaw that already requires an administrative/high-privilege foothold is not a drop-everything priority. The main caveat is that the PR:H requirement means an attacker must already hold high privileges on the appliance, which sharply limits realistic risk.

An attacker who already holds high-privileged (administrative-level) access to a Dell PowerProtect Data Domain appliance sends crafted input over the network to a vulnerable component, triggering a stack-based buffer overflow that crashes the service and causes a denial of service. The specific trigger mechanism is not described in the available sources. No public exploit or PoC was identified in the input.