OpenVAS Scanner EUVD-2026-66955

Exploitation requires the attacker to hold user-level privileges on the target Greenbone GVM or OpenVAS deployment - specifically, the ability to upload, inject, or modify NASL VT content in the scanner's feed or task configuration. The malicious VT must subsequently be invoked by the openvas-scanner process during a scan task execution. Unauthenticated remote attackers cannot directly trigger the overflow (PR:L per CVSS 4.0 vector). Limiting factors include: the mandatory user authentication prerequisite, the need for the crafted VT to be scheduled and run by the scanner, and the requirement that VT upload capability is granted to the attacker's account. Environments that restrict VT management to read-only official Greenbone feed subscriptions and tightly control user account provisioning significantly reduce the realistic attack surface beyond the raw CVSS score.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) reflects a high-severity, low-complexity network attack requiring only user-level credentials and no user interaction - realistic in any GVM instance with multiple provisioned accounts. No CISA KEV listing exists and no public exploit code has been identified, which moderates the immediate mass-exploitation risk. The realistic threat model is a malicious insider or a user account compromised via phishing or credential stuffing, both of which are operationally plausible in security-team tooling environments. The 'malicious or compromised VT' framing means the attack surface is the VT management interface: any principal able to push or modify VT content is a potential attacker. No EPSS score is available in the provided data, limiting probabilistic comparison. The absence of constrained version ranges in the CPE data means the full scope of affected deployments cannot yet be confirmed from NVD alone - the vendor advisory is authoritative.

An attacker who has obtained user credentials on a Greenbone GVM deployment - through phishing, credential stuffing, or insider access - uploads a specially crafted NASL VT to the scanner's feed or task configuration. When the openvas-scanner process executes the malicious VT during a scan task, the crafted content triggers a stack buffer overflow in the NASL interpreter, overwriting the return address and redirecting execution to attacker-controlled code. The result is arbitrary code execution at the privilege level of the scanner process, which in enterprise deployments often operates with elevated permissions and access to stored credentials for scanned network assets.