EUVD-2026-53843
GHSA-ffmw-m245-3h88
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local-only stack overrun triggered by low-privileged user with no user interaction; impact is availability-only with no confidentiality or integrity effect and no scope change.
Primary rating from Vendor (5f57b9bf-260d-4433-bf07-b6a79e9bb7d4).
CVSS VectorVendor: 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4
Lifecycle Timeline
1DescriptionCVE.org
A denial-of-service vulnerability in CatchPulse could allow an attacker to conduct a stack buffer overrun attack, leading to a denial-of-service condition.
AnalysisAI
Stack buffer overrun in SecureAge CatchPulse allows a local low-privileged attacker to crash the application, producing a denial-of-service condition. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only an authenticated local session with no user interaction, making it viable for insider threats or post-compromise lateral DoS. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Technical ContextAI
CatchPulse is an endpoint security product developed by SecureAge. The vulnerability involves a classic stack buffer overrun - insufficient bounds validation allows an attacker to write data beyond the bounds of a stack-allocated buffer, corrupting adjacent stack memory. This typically manifests as an abnormal process termination or system crash. While the input CWE field is listed as N/A, the explicit mention of 'stack buffer overrun' maps to CWE-121 (Stack-based Buffer Overflow). The CVSS base vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H is internally consistent with a local, low-complexity DoS that does not escape the vulnerable component's security scope. Notably, the supplied tag 'Information Disclosure' conflicts with the CVSS impact vector (C:N) and the described DoS-only outcome - this discrepancy should be verified against the vendor advisory.
RemediationAI
Consult the SecureAge security vulnerabilities page (https://www.secureage.com/security-vulnerabilities) for the vendor-released patch and exact fixed version - no specific fix version was confirmed from the available data at time of analysis. The CSA Singapore advisory AL-2026-098 (https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-098/) may provide additional remediation guidance and version specifics. As an interim compensating control, restrict local interactive logon rights on systems running CatchPulse to the minimum necessary user population, reducing the set of principals who could trigger the overrun. Monitoring for abnormal CatchPulse process crashes via endpoint telemetry can serve as a detection indicator while patching is pending.
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today