PowerProtect Data Domain EUVD-2026-111978

Requires network reachability to an affected Dell PowerProtect Data Domain service AND valid low-privileged authentication to the appliance (CVSS PR:L) - it is not exploitable by a fully unauthenticated attacker. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The specific feature, protocol, SAPI or configuration that exposes the vulnerable code path is not described in the available sources, so the concrete trigger surface cannot be named. Limiting factors for defenders: the credential requirement means exposure is gated by who can authenticate to the appliance, and only the listed version ranges across the FR, LTS2024, LTS2025 and LTS2026 branches are affected.

Signals point in a consistent but non-emergency direction. The CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning remote, low-complexity exploitation that nonetheless requires authentication (PR:L) and yields high confidentiality, integrity and availability impact without a scope change. The vuln.today decision label is 'this_week', indicating a prioritized-but-not-immediate response. No EPSS score, no CISA KEV listing, and no PoC or exploit reference were supplied, so there is no evidence of active or imminent exploitation - the absence of these signals is not itself proof of safety, but it argues against drop-everything urgency. The key tension is that PR:L requires the attacker to already hold valid low-privileged credentials on the appliance, which materially limits exploitation versus a fully unauthenticated flaw; this is why the 8.8 score should be read as 'serious for anyone who can reach and authenticate to the appliance' rather than 'wormable internet-facing threat'. A secondary data concern: the input tags include 'Authentication Bypass', which conflicts with the CWE-121 stack-based buffer overflow classification and the PR:L requirement - verify the mechanism against the Dell advisory rather than treating this as an auth-bypass bug.

An attacker holding low-privileged credentials on a Dell PowerProtect Data Domain appliance (for example a limited operator account, or a foothold obtained earlier) sends crafted input over the network to an affected service and triggers a stack-based buffer overflow. The overflow results in unauthorized access, potentially corrupting memory to escalate privileges or compromise the appliance. No public exploit was identified at time of analysis, and the exact trigger is not described in the available sources.