Tanium Index EUVD-2026-111246

Exploitation requires local access to a host running the affected Tanium Index component (index-cx) or the Endpoint Configuration Toolset Solution, plus low-level privileges (CVSS AV:L, PR:L) - this is not remotely or unauthenticatedly exploitable. The flaw is a heap-based buffer overflow in the Index component; the specific input, feature, or configuration that triggers it is not described in the available sources. Limiting factors that reduce real-world risk: the attacker must already have authenticated/local execution on the endpoint, and no network vector or user-interaction-free remote path exists per the supplied vector. Affected and fixed builds per EUVD are index-cx (fixed at 3.9.520, 3.11.443, 3.14.917, 3.14.921, 3.15.2420, 3.16.984) and Endpoint Configuration Toolset Solution (fixed at 1.51.60, 1.59.50, 1.71.25); updating to the vendor-fixed build is the remediation indicated by the available data.

This is a genuinely actionable but not emergency-grade issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) describes a locally-exploitable flaw requiring the attacker to already hold low-level privileges on the host, which substantially narrows the threat model versus a remote unauthenticated bug - despite the 7.8 'High' score, this is a privilege-escalation / local-impact class issue, not a remotely wormable one. Impact is high across confidentiality, integrity and availability (C:H/I:H/A:H), consistent with memory-corruption-driven code execution in the Index component. No EPSS score, no CISA KEV listing, and no PoC or exploit reference are present in the supplied data, so there is no public signal of exploitation or exploit availability. The vuln.today decision label is 'this_week', indicating prompt but not emergency remediation. Net: treat as a prioritized patch within the current week for Tanium endpoints, not a drop-everything event - the local, authenticated prerequisite is the key mitigating factor against the otherwise high technical impact.

An attacker who has already obtained a low-privileged foothold on a host running the Tanium Index component supplies crafted input that is processed by Index, triggering the heap-based buffer overflow (CWE-122) and corrupting heap memory to achieve code execution or a crash at the privilege level of the Index process. Because the CVSS vector is AV:L/PR:L, this is a local, authenticated scenario used to escalate privileges or compromise the endpoint rather than a remote intrusion. No public exploit code or PoC reference is present in the supplied data; the specific trigger is not described in the available sources.