Tanium Client EUVD-2026-116540

Exploitation requires network adjacency (AV:A): the attacker must reach the Tanium Client from the same local segment or broadcast domain, not across the open internet, which is the primary limiting factor. No authentication is needed (PR:N) and no user interaction is required (UI:N), and the flaw affects default client deployments since no special feature or configuration mode is named in the advisory. The exact message or input that triggers the integer overflow is not described in the available sources. Impact is limited to denial of service (availability) of the Tanium Client agent; there is no confidentiality or integrity effect.

This is a moderate-severity availability issue (CVSS 6.5) rather than a top-tier emergency. The CVSS vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H tells a consistent story: exploitation needs no authentication (PR:N) and no user interaction (UI:N) with low complexity (AC:L), but it is constrained to an adjacent network (AV:A), not the full internet, and impact is limited to availability only (C:N/I:N/A:H) - no data disclosure or integrity loss. The vuln.today decision label is 'this_month', which signals a prioritized-but-not-urgent remediation window, consistent with a DoS-only flaw. There is no CISA KEV listing and no EPSS score supplied, so there is no evidence of active exploitation or a high predicted-exploitation probability; the only reference is the vendor's own advisory (TAN-2026-086), not a working exploit. Net: this is a real priority for Tanium-managed environments because the agent runs on every managed endpoint, but the adjacent-network requirement and availability-only impact keep it below the level of a drop-everything critical. Note the AV:A/PR:N combination means an attacker already needs a foothold on the same network segment, which materially limits real-world reach.

An attacker positioned on the same local or adjacent network segment as a managed endpoint sends crafted traffic to the Tanium Client that triggers the integer overflow (CWE-190), crashing or hanging the agent and denying its endpoint-management function. No credentials or user interaction are required, but the attacker must already have adjacent-network access. No public exploit code was identified at the time of analysis; the only available source is the vendor advisory.