Vulnerability-Lookup

CVE-2026-105437 (GCVE-0-2026-105437)

Vulnerability from cvelistv5 – Published: 2026-11-10 18:34 – Updated: 2026-11-10 18:34

Title

Heap-based Buffer Overflow in Git

Summary

Affected versions of Git have a heap buffer overflow in the three-way merge code (xdiff), which an attacker can trigger through a repository they control. When Git merges a file, it first adds up the size of the merged output, allocates a buffer of that size, and then writes the output into it. That total was kept in a 32-bit signed integer. The conflict-marker-size attribute, which can be set from a committed .gitattributes file, accepts any positive integer, and the markers are written several times for every conflict. A small file with a huge marker size and many separate conflicts can therefore push the total past 4 GiB, so the integer wraps to a small value and Git writes attacker-controlled merge output past the end of a buffer that is too small. At minimum this crashes Git, and because the overflow is large and its contents are largely attacker-controlled, worse heap corruption is possible. Any command that does a textual three-way merge can trigger it, such as git-merge(1), git-rebase(1), git-cherry-pick(1), and git-merge-tree(1). The latter is most likely a target for Git forges, which might use git-merge-tree(1) on the server-side to check mergeability. When the server reads attributes from trees in the repository (for example through attr.tree or --attr-source), any user who can push branches and request that they be merged (for example by opening a pull or merge request) can trigger the overflow without anyone else doing anything, and the data they push is small because the oversized output only appears during the merge. The problem has been patched by computing the size as size_t and checking every addition for overflow, so Git stops with an error instead of overflowing. Servers that cannot upgrade right away can add * conflict-marker-size=7 to each repository's info/attributes as a workaround, which overrides any in-tree .gitattributes, or turn off server-side mergeability checks for untrusted repositories.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-122 - Heap-based Buffer Overflow

Assigner

GitLab CNA under the mitre root

CNA scorecard C 74/100 over 299 records in the last 180 days details

References

3 references

URL	Tags
https://gitlab.com/gitlab-org/git/-/work_items/814
https://gitlab.com/gitlab-org/gitlab/-/work_items…
https://hackerone.com/reports/4044249	technical-descriptionexploitpermissions-required

Impacted products

1 product

Vendor	Product	Version	CPE status
Git	Git	Affected: 0 , < 2.49.1 (semver) Affected: 2.50.0-rc0 , < 2.50.2 (semver) Affected: 2.51.0-rc0 , < 2.51.3 (semver) Affected: 2.52.0-rc0 , < 2.52.1 (semver) Affected: 2.53.0-rc0 , < 2.53.1 (semver) Affected: 2.54.0-rc0 , < 2.54.1 (semver) Affected: 2.55.0-rc0 , < 2.55.1 (semver) Affected: 2.56.0-rc0 , < 2.56.1 (semver) cpe:2.3:a:git-scm:git::::::::

Credits

Thanks [taise](https://hackerone.com/taise) for reporting this vulnerability through HackerOne

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "Git",
          "repo": "https://gitlab.com/git-scm/git",
          "vendor": "Git",
          "versions": [
            {
              "lessThan": "2.49.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.50.2",
              "status": "affected",
              "version": "2.50.0-rc0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.51.3",
              "status": "affected",
              "version": "2.51.0-rc0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.52.1",
              "status": "affected",
              "version": "2.52.0-rc0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.53.1",
              "status": "affected",
              "version": "2.53.0-rc0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.54.1",
              "status": "affected",
              "version": "2.54.0-rc0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.55.1",
              "status": "affected",
              "version": "2.55.0-rc0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.56.1",
              "status": "affected",
              "version": "2.56.0-rc0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Thanks [taise](https://hackerone.com/taise) for reporting this vulnerability through HackerOne"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Affected versions of Git have a heap buffer overflow in the three-way merge\ncode (xdiff), which an attacker can trigger through a repository they\ncontrol.\n\nWhen Git merges a file, it first adds up the size of the merged\noutput, allocates a buffer of that size, and then writes the output into\nit. That total was kept in a 32-bit signed integer. The\nconflict-marker-size attribute, which can be set from a committed\n.gitattributes file, accepts any positive integer, and the markers are\nwritten several times for every conflict. A small file with a huge marker\nsize and many separate conflicts can therefore push the total past 4 GiB,\nso the integer wraps to a small value and Git writes attacker-controlled\nmerge output past the end of a buffer that is too small. At minimum this\ncrashes Git, and because the overflow is large and its contents are largely\nattacker-controlled, worse heap corruption is possible.\n\nAny command that does a textual three-way merge can trigger it, such\nas git-merge(1), git-rebase(1), git-cherry-pick(1), and\ngit-merge-tree(1). The latter is most likely a target for Git forges,\nwhich might use git-merge-tree(1) on the server-side to check\nmergeability. When the server reads attributes from trees in the\nrepository (for example through attr.tree or --attr-source), any\nuser who can push branches and request that they be merged (for\nexample by opening a pull or merge request) can trigger the overflow\nwithout anyone else doing anything, and the data they push is small\nbecause the oversized output only appears during the merge.\n\nThe problem has been patched by computing the size as size_t and\nchecking every addition for overflow, so Git stops with an error\ninstead of overflowing.\n\nServers that cannot upgrade right away can add\n\n* conflict-marker-size=7\n\nto each repository\u0027s info/attributes as a workaround, which overrides\nany in-tree .gitattributes, or turn off server-side mergeability checks for\nuntrusted repositories."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122: Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T18:34:09.369Z",
        "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "shortName": "GitLab"
      },
      "references": [
        {
          "url": "https://gitlab.com/gitlab-org/git/-/work_items/814"
        },
        {
          "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/632121"
        },
        {
          "name": "HackerOne Bug Bounty Report #4044249",
          "tags": [
            "technical-description",
            "exploit",
            "permissions-required"
          ],
          "url": "https://hackerone.com/reports/4044249"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to versions 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1, 2.55.1, 2.56.1 or above."
        }
      ],
      "title": "Heap-based Buffer Overflow in Git"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
    "assignerShortName": "GitLab",
    "cveId": "CVE-2026-105437",
    "datePublished": "2026-11-10T18:34:09.369Z",
    "dateReserved": "2026-10-05T13:05:02.346Z",
    "dateUpdated": "2026-11-10T18:34:09.369Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "product": "Git",
                "repo": "https://gitlab.com/git-scm/git",
                "vendor": "Git",
                "versions": [
                  {
                    "lessThan": "2.49.1",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "2.50.2",
                    "status": "affected",
                    "version": "2.50.0-rc0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "2.51.3",
                    "status": "affected",
                    "version": "2.51.0-rc0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "2.52.1",
                    "status": "affected",
                    "version": "2.52.0-rc0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "2.53.1",
                    "status": "affected",
                    "version": "2.53.0-rc0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "2.54.1",
                    "status": "affected",
                    "version": "2.54.0-rc0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "2.55.1",
                    "status": "affected",
                    "version": "2.55.0-rc0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "2.56.1",
                    "status": "affected",
                    "version": "2.56.0-rc0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "cve@gitlab.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Affected versions of Git have a heap buffer overflow in the three-way merge\ncode (xdiff), which an attacker can trigger through a repository they\ncontrol.\n\nWhen Git merges a file, it first adds up the size of the merged\noutput, allocates a buffer of that size, and then writes the output into\nit. That total was kept in a 32-bit signed integer. The\nconflict-marker-size attribute, which can be set from a committed\n.gitattributes file, accepts any positive integer, and the markers are\nwritten several times for every conflict. A small file with a huge marker\nsize and many separate conflicts can therefore push the total past 4 GiB,\nso the integer wraps to a small value and Git writes attacker-controlled\nmerge output past the end of a buffer that is too small. At minimum this\ncrashes Git, and because the overflow is large and its contents are largely\nattacker-controlled, worse heap corruption is possible.\n\nAny command that does a textual three-way merge can trigger it, such\nas git-merge(1), git-rebase(1), git-cherry-pick(1), and\ngit-merge-tree(1). The latter is most likely a target for Git forges,\nwhich might use git-merge-tree(1) on the server-side to check\nmergeability. When the server reads attributes from trees in the\nrepository (for example through attr.tree or --attr-source), any\nuser who can push branches and request that they be merged (for\nexample by opening a pull or merge request) can trigger the overflow\nwithout anyone else doing anything, and the data they push is small\nbecause the oversized output only appears during the merge.\n\nThe problem has been patched by computing the size as size_t and\nchecking every addition for overflow, so Git stops with an error\ninstead of overflowing.\n\nServers that cannot upgrade right away can add\n\n* conflict-marker-size=7\n\nto each repository\u0027s info/attributes as a workaround, which overrides\nany in-tree .gitattributes, or turn off server-side mergeability checks for\nuntrusted repositories."
          }
        ],
        "id": "CVE-2026-105437",
        "lastModified": "2026-11-10T19:17:46.200",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 5.9,
              "source": "cve@gitlab.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-11-10T19:17:46.200",
        "references": [
          {
            "source": "cve@gitlab.com",
            "url": "https://gitlab.com/gitlab-org/git/-/work_items/814"
          },
          {
            "source": "cve@gitlab.com",
            "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/632121"
          },
          {
            "source": "cve@gitlab.com",
            "url": "https://hackerone.com/reports/4044249"
          }
        ],
        "sourceIdentifier": "cve@gitlab.com",
        "vulnStatus": "Received",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-122"
              }
            ],
            "source": "cve@gitlab.com",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-11-11T07:25:17+00:00",
      "cve": "CVE-2026-105437",
      "id": "CVE-2026-105437",
      "initial_release_date": "2026-11-10T18:00:00+00:00",
      "product_status:known_affected": "73",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "git: git: Heap corruption via integer overflow in merge size calculations",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105437.json",
      "version": "3"
    }
  }
}

FKIE_CVE-2026-105437

Vulnerability from fkie_nvd - Published: 2026-11-10 19:17 - Updated: 2026-11-10 19:17

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	cve@gitlab.com	https://gitlab.com/gitlab-org/git/-/work_items/814
	cve@gitlab.com	https://gitlab.com/gitlab-org/gitlab/-/work_items/632121
	cve@gitlab.com	https://hackerone.com/reports/4044249

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "Git",
          "repo": "https://gitlab.com/git-scm/git",
          "vendor": "Git",
          "versions": [
            {
              "lessThan": "2.49.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.50.2",
              "status": "affected",
              "version": "2.50.0-rc0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.51.3",
              "status": "affected",
              "version": "2.51.0-rc0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.52.1",
              "status": "affected",
              "version": "2.52.0-rc0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.53.1",
              "status": "affected",
              "version": "2.53.0-rc0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.54.1",
              "status": "affected",
              "version": "2.54.0-rc0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.55.1",
              "status": "affected",
              "version": "2.55.0-rc0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.56.1",
              "status": "affected",
              "version": "2.56.0-rc0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "cve@gitlab.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Affected versions of Git have a heap buffer overflow in the three-way merge\ncode (xdiff), which an attacker can trigger through a repository they\ncontrol.\n\nWhen Git merges a file, it first adds up the size of the merged\noutput, allocates a buffer of that size, and then writes the output into\nit. That total was kept in a 32-bit signed integer. The\nconflict-marker-size attribute, which can be set from a committed\n.gitattributes file, accepts any positive integer, and the markers are\nwritten several times for every conflict. A small file with a huge marker\nsize and many separate conflicts can therefore push the total past 4 GiB,\nso the integer wraps to a small value and Git writes attacker-controlled\nmerge output past the end of a buffer that is too small. At minimum this\ncrashes Git, and because the overflow is large and its contents are largely\nattacker-controlled, worse heap corruption is possible.\n\nAny command that does a textual three-way merge can trigger it, such\nas git-merge(1), git-rebase(1), git-cherry-pick(1), and\ngit-merge-tree(1). The latter is most likely a target for Git forges,\nwhich might use git-merge-tree(1) on the server-side to check\nmergeability. When the server reads attributes from trees in the\nrepository (for example through attr.tree or --attr-source), any\nuser who can push branches and request that they be merged (for\nexample by opening a pull or merge request) can trigger the overflow\nwithout anyone else doing anything, and the data they push is small\nbecause the oversized output only appears during the merge.\n\nThe problem has been patched by computing the size as size_t and\nchecking every addition for overflow, so Git stops with an error\ninstead of overflowing.\n\nServers that cannot upgrade right away can add\n\n* conflict-marker-size=7\n\nto each repository\u0027s info/attributes as a workaround, which overrides\nany in-tree .gitattributes, or turn off server-side mergeability checks for\nuntrusted repositories."
    }
  ],
  "id": "CVE-2026-105437",
  "lastModified": "2026-11-10T19:17:46.200",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 5.9,
        "source": "cve@gitlab.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-11-10T19:17:46.200",
  "references": [
    {
      "source": "cve@gitlab.com",
      "url": "https://gitlab.com/gitlab-org/git/-/work_items/814"
    },
    {
      "source": "cve@gitlab.com",
      "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/632121"
    },
    {
      "source": "cve@gitlab.com",
      "url": "https://hackerone.com/reports/4044249"
    }
  ],
  "sourceIdentifier": "cve@gitlab.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-122"
        }
      ],
      "source": "cve@gitlab.com",
      "type": "Primary"
    }
  ]
}

GHSA-M7R7-8V36-J77R

Vulnerability from github – Published: 2026-11-10 21:32 – Updated: 2026-11-10 21:32

Details

Affected versions of Git have a heap buffer overflow in the three-way merge code (xdiff), which an attacker can trigger through a repository they control.

When Git merges a file, it first adds up the size of the merged output, allocates a buffer of that size, and then writes the output into it. That total was kept in a 32-bit signed integer. The conflict-marker-size attribute, which can be set from a committed .gitattributes file, accepts any positive integer, and the markers are written several times for every conflict. A small file with a huge marker size and many separate conflicts can therefore push the total past 4 GiB, so the integer wraps to a small value and Git writes attacker-controlled merge output past the end of a buffer that is too small. At minimum this crashes Git, and because the overflow is large and its contents are largely attacker-controlled, worse heap corruption is possible.

Any command that does a textual three-way merge can trigger it, such as git-merge(1), git-rebase(1), git-cherry-pick(1), and git-merge-tree(1). The latter is most likely a target for Git forges, which might use git-merge-tree(1) on the server-side to check mergeability. When the server reads attributes from trees in the repository (for example through attr.tree or --attr-source), any user who can push branches and request that they be merged (for example by opening a pull or merge request) can trigger the overflow without anyone else doing anything, and the data they push is small because the oversized output only appears during the merge.

The problem has been patched by computing the size as size_t and checking every addition for overflow, so Git stops with an error instead of overflowing.

Servers that cannot upgrade right away can add

conflict-marker-size=7

to each repository's info/attributes as a workaround, which overrides any in-tree .gitattributes, or turn off server-side mergeability checks for untrusted repositories.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-105437"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-122"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-11-10T19:17:46Z",
    "severity": "HIGH"
  },
  "details": "Affected versions of Git have a heap buffer overflow in the three-way merge\ncode (xdiff), which an attacker can trigger through a repository they\ncontrol.\n\nWhen Git merges a file, it first adds up the size of the merged\noutput, allocates a buffer of that size, and then writes the output into\nit. That total was kept in a 32-bit signed integer. The\nconflict-marker-size attribute, which can be set from a committed\n.gitattributes file, accepts any positive integer, and the markers are\nwritten several times for every conflict. A small file with a huge marker\nsize and many separate conflicts can therefore push the total past 4 GiB,\nso the integer wraps to a small value and Git writes attacker-controlled\nmerge output past the end of a buffer that is too small. At minimum this\ncrashes Git, and because the overflow is large and its contents are largely\nattacker-controlled, worse heap corruption is possible.\n\nAny command that does a textual three-way merge can trigger it, such\nas git-merge(1), git-rebase(1), git-cherry-pick(1), and\ngit-merge-tree(1). The latter is most likely a target for Git forges,\nwhich might use git-merge-tree(1) on the server-side to check\nmergeability. When the server reads attributes from trees in the\nrepository (for example through attr.tree or --attr-source), any\nuser who can push branches and request that they be merged (for\nexample by opening a pull or merge request) can trigger the overflow\nwithout anyone else doing anything, and the data they push is small\nbecause the oversized output only appears during the merge.\n\nThe problem has been patched by computing the size as size_t and\nchecking every addition for overflow, so Git stops with an error\ninstead of overflowing.\n\nServers that cannot upgrade right away can add\n\n* conflict-marker-size=7\n\nto each repository\u0027s info/attributes as a workaround, which overrides\nany in-tree .gitattributes, or turn off server-side mergeability checks for\nuntrusted repositories.",
  "id": "GHSA-m7r7-8v36-j77r",
  "modified": "2026-11-10T21:32:18Z",
  "published": "2026-11-10T21:32:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105437"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/4044249"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/git/-/work_items/814"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/632121"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-105437 (GCVE-0-2026-105437)

FKIE_CVE-2026-105437

GHSA-M7R7-8V36-J77R

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour