What is the CVSS score of EUVD-2026-59751?

EUVD-2026-59751 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate EUVD-2026-59751?

Within 24 hours, identify and catalog all systems running vulnerable Linux kernel versions (prior to 6.6.151, 6.12.103, 6.18.44, 7.1.8, or 7.2-rc6) and apply temporary restrictions on local user access pending patching. Within 7 days, deploy kernel patches from stable branches 6.6.151 or later across all systems following your change management procedures, prioritizing production virtual desktops and workstations. Within 30 days, verify complete remediation through automated kernel version scanning, confirm patch acceptance in baseline images, and document remediation status for audit compliance.

Linux Kernel EUVD-2026-59751

| CVE-2026-74444 HIGH

2026-08-15 Linux

GHSA-m498-64hg-9w93

Buffer Overflow Linux

7.8

CVSS 3.1 · Vendor: Linux

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Obtain low-privilege shell on VMware guest OS
Delivery

Craft DRAW_PRIMITIVES command with header->size below sizeof(cmd->body)
Exploit

Submit payload via DRM device node ioctl
Execution

Unsigned subtraction wraps to ~4 GiB maxnum
Persist

Kernel loop iterates past bounce buffer boundary
Impact

Read arbitrary kernel memory contents

Vulnerability Assessment

Exploitation Conditions	Exploitation requires all of the following: (1) local interactive or shell access to a Linux system running as a VMware guest - the vmwgfx driver is only active on VMware SVGA II virtual hardware and is not present on bare-metal or non-VMware hypervisor configurations; (2) a low-privilege user account with read/write access to the DRM device node (/dev/dri/renderD* or /dev/dri/card*), which typically requires membership in the 'video' or 'render' group; (3) a kernel version from Linux 2.6.33 onwards with vmwgfx compiled in or loaded as a module, and not yet patched to 6.6.151, 6.12.103, 6.18.44, or 7.1.8. Exploitation is blocked where: the vmwgfx module is blacklisted or absent; the system runs on bare-metal or a non-VMware hypervisor; DRM device node access is restricted to root; or a patched kernel version is deployed. No network access, authentication bypass, or remote vector is involved.
Impact	The CVSS 7.8 score with AV:L/AC:L/PR:L/UI:N reflects a locally exploitable flaw requiring only low-privilege user access - no special configuration complexity or user interaction is needed - meaning even a mid-sized municipal IT team in mielec running VMware-based virtual desktop infrastructure should treat this as a credible local escalation risk in their VM guest OS environments. However, the EPSS score of 0.17% (6th percentile) indicates extremely low observed exploitation probability at time of analysis, and the absence from CISA KEV confirms no widespread in-the-wild exploitation. The vendor-assigned C:H/I:H/A:H metrics warrant scrutiny: the described primitive is an OOB read, and I:H and A:H attribution is plausible only if the kernel memory read can be chained into a write primitive or reliably cause a crash - neither is explicitly confirmed in the available description. Practical attack surface is further constrained to VMware guest environments where the vmwgfx module is loaded and the user has access to a DRM device node, limiting exposure compared to a generic kernel vulnerability.
Exploit ScenarioDerived	A local user with a low-privilege shell on a Linux VM running on VMware infrastructure opens the DRM render device node and submits a crafted DRAW_PRIMITIVES command with header->size set to a value smaller than sizeof(cmd->body). The unsigned subtraction wraps to approximately 4 GiB, and with numVertexDecls set to a large attacker-controlled value, the kernel loop walks far beyond the allocated bounce buffer, reading arbitrary kernel memory that may contain credentials, cryptographic material, or pointers useful for further exploitation. No public exploit code has been identified, but the vulnerability requires only a carefully crafted ioctl payload - no complex heap grooming or timing dependency is described.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 17, 2026

Out-of-bounds kernel memory read in the Linux kernel's vmwgfx DRM driver exposes systems running VMware-virtualized graphics to local privilege escalation or sensitive information disclosure. The flaw in vmw_cmd_draw() allows a low-privilege local user to supply a crafted DRAW_PRIMITIVES command stream header with an undersized size field, triggering unsigned integer underflow that produces a near-4 GiB loop bound and causes the kernel to dereference memory far beyond the allocated command bounce buffer. Patches are available across multiple stable kernel branches (6.6.151, 6.12.103, 6.18.44, 7.1.8, 7.2-rc6); no active exploitation has been confirmed and the vulnerability is not listed in CISA KEV.

RemediationAI

Upgrade to a fixed Linux kernel: stable releases 6.6.151, 6.12.103, 6.18.44, or 7.1.8 are available; pre-release users should target 7.2-rc6. The upstream fix validates header->size against sizeof(cmd->body) before performing the subtraction, rejecting undersized headers upfront. Stable-branch patches are available at: https://git.kernel.org/stable/c/2666cddf0dd218aa9bd1f99db688d1b532eac21a, https://git.kernel.org/stable/c/fc0c02f510e41650df3479f96e257acf87d8a20a, https://git.kernel.org/stable/c/dc0be7662b7b0ce28cb5eea864737793ed7b9e70, https://git.kernel.org/stable/c/c77cf8edae2bd3a1599115301cc7c98d0c78e731, and https://git.kernel.org/stable/c/85891d174707d8bddcec7a888fb4e1d17def34f3. If immediate kernel upgrade is not feasible, unloading the vmwgfx module (rmmod vmwgfx) eliminates the vulnerable code path entirely at the cost of disabling VMware virtual GPU acceleration - acceptable for headless server VMs. Restricting DRM device node permissions (chmod o-rw /dev/dri/*) narrows the set of local users who can reach the vulnerable ioctl, though this will break desktop graphics for non-root users and should be validated against workload requirements before deployment.

Affected VersionsENISA

Linux 7a73ba7469cbea631050094fd14f73acebb97cf9 <85891d174707d8bddcec7a888fb4e1d17def34f3

Linux 7a73ba7469cbea631050094fd14f73acebb97cf9 <2666cddf0dd218aa9bd1f99db688d1b532eac21a

Linux 7a73ba7469cbea631050094fd14f73acebb97cf9 <c77cf8edae2bd3a1599115301cc7c98d0c78e731

Linux 2.6.33

Linux patch: 0

Linux patch: 7.1.8

Linux patch: 6.18.44

Linux patch: 6.12.103

Linux patch: 7.2-rc6

Linux 7a73ba7469cbea631050094fd14f73acebb97cf9 <fc0c02f510e41650df3479f96e257acf87d8a20a

Linux 7a73ba7469cbea631050094fd14f73acebb97cf9 <dc0be7662b7b0ce28cb5eea864737793ed7b9e70

Linux patch: 6.6.151

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The affected component is vmwgfx, the Linux kernel's DRM (Direct Rendering Manager) driver for the VMware SVGA II virtual GPU, active only on VMware-based virtual machines. The root cause is an unsigned integer underflow in vmw_cmd_draw(): the expression (header->size - sizeof(cmd->body)) / sizeof(*decl) performs an unsigned u32 subtraction. When header->size - fully attacker-controlled from the user-supplied command stream - is smaller than sizeof(cmd->body), the unsigned arithmetic wraps to approximately 4 GiB, yielding a near-maximal maxnum. The subsequent loop iterates with the attacker-controlled cmd->body.numVertexDecls past the end of the kernel bounce buffer, producing an out-of-bounds read of kernel memory. Although no CWE is formally assigned, the primitive maps to CWE-191 (Integer Underflow) chained to CWE-125 (Out-of-Bounds Read). CPE data identifies the affected product as cpe:2.3:a:linux:linux:*, with the vulnerability introduced at commit 7a73ba7469cbea631050094fd14f73acebb97cf9, corresponding to Linux 2.6.33.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 6.1 MEDIUM

Local OOB read yields high confidentiality impact; integrity impact absent for a read-only primitive; availability limited to potential kernel crash.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

SUSE HIGH

Red Hat 5.5 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Aug 17, 2026 - 06:22 NVD

7.8 (HIGH)

Patch available

Aug 15, 2026 - 13:04 EUVD

CVE Published

Aug 15, 2026 - 12:26 cve.org

HIGH 7.8

CVE Published

Aug 15, 2026 - 12:26 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: validate DRAW_PRIMITIVES header size before division

vmw_cmd_draw() computes

maxnum = (header->size - sizeof(cmd->body)) / sizeof(*decl);

where header->size is u32 and is taken straight from the user-supplied command stream. When header->size is less than sizeof(cmd->body) the unsigned subtraction wraps to nearly 4 GiB, producing a huge maxnum. Any user-controlled cmd->body.numVertexDecls then passes the bound and the loop dereferences decl[i] far past the end of the kernel command bounce buffer, producing an out-of-bounds read of kernel memory.

Reject undersized headers up front.

Executive ViewAI

Why It Matters

Linux kernel systems running VMware graphics virtualization contain a local privilege escalation vulnerability allowing standard users to gain administrative access, creating risk of data exfiltration and lateral movement within virtualized environments. The flaw affects organizations with VMware-based virtual desktop infrastructure, particularly those supporting remote and hybrid workforces. Vendor patches are available, enabling prompt containment of this risk.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 94% exploitable

Prevalence

Medium

VMware guest driver, common in enterprise virtualized infrastructure

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS MSRC Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +39

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

References

Advisories & patches

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back