GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89524 (GCVE-0-2026-89524)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:44 – Updated: 2026-09-14 12:00
VLAI
Title
wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets ath6kl_cfg80211_connect_event() subtracts fixed IE offsets from assoc_req_len (-= 4) and assoc_resp_len (-= 6), both u8, with no lower bound. The aggregate check recently added to ath6kl_wmi_connect_event_rx() bounds the declared lengths from above (their sum must fit the received event), but an assoc request/response shorter than its fixed offset still underflows here: the u8 wraps to ~250, and cfg80211_connect_result() / cfg80211_roamed() then treat that wrapped value as the IE length and copy that many bytes out of the small assoc_info buffer to user space via nl80211, disclosing adjacent slab memory. Clamp both lengths to their offsets before subtracting. Found by 0sec (https://0sec.ai) using automated source analysis; the missing lower bound is evident from source. Compile-tested.
Severity
8.1 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: bdcd81707973cf8aa9305337166f8ee842a050d4 , < 225587bdbf4b0eb5265a71ee4dc183561a1857fc (git)
Affected: bdcd81707973cf8aa9305337166f8ee842a050d4 , < d337213a889705a69735079606d0b4c672b17605 (git)
Affected: bdcd81707973cf8aa9305337166f8ee842a050d4 , < e11d5ae96d5e52cb48fa27c6ad352d766d0322fb (git)
Affected: bdcd81707973cf8aa9305337166f8ee842a050d4 , < 6deb4d7a0c3d91821b2a8d5239e3d9933d9217d9 (git)
Affected: bdcd81707973cf8aa9305337166f8ee842a050d4 , < e3619bed5da125713b29ac881dc66f5e06606f88 (git)
Affected: bdcd81707973cf8aa9305337166f8ee842a050d4 , < e1330d719c047c4d8190a16be034b29fc601a815 (git)
Affected: bdcd81707973cf8aa9305337166f8ee842a050d4 , < 8eb73016fb3968cf2db3987a92764563a3af773a (git)
Affected: bdcd81707973cf8aa9305337166f8ee842a050d4 , < 3bbd05723d15dd06f0560bcd94fbf9a91b5f5613 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.2
Unaffected: 0 , < 3.2 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath6kl/cfg80211.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "225587bdbf4b0eb5265a71ee4dc183561a1857fc",
              "status": "affected",
              "version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
              "versionType": "git"
            },
            {
              "lessThan": "d337213a889705a69735079606d0b4c672b17605",
              "status": "affected",
              "version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
              "versionType": "git"
            },
            {
              "lessThan": "e11d5ae96d5e52cb48fa27c6ad352d766d0322fb",
              "status": "affected",
              "version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
              "versionType": "git"
            },
            {
              "lessThan": "6deb4d7a0c3d91821b2a8d5239e3d9933d9217d9",
              "status": "affected",
              "version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
              "versionType": "git"
            },
            {
              "lessThan": "e3619bed5da125713b29ac881dc66f5e06606f88",
              "status": "affected",
              "version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
              "versionType": "git"
            },
            {
              "lessThan": "e1330d719c047c4d8190a16be034b29fc601a815",
              "status": "affected",
              "version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
              "versionType": "git"
            },
            {
              "lessThan": "8eb73016fb3968cf2db3987a92764563a3af773a",
              "status": "affected",
              "version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
              "versionType": "git"
            },
            {
              "lessThan": "3bbd05723d15dd06f0560bcd94fbf9a91b5f5613",
              "status": "affected",
              "version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath6kl/cfg80211.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.2"
            },
            {
              "lessThan": "3.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets\n\nath6kl_cfg80211_connect_event() subtracts fixed IE offsets from\nassoc_req_len (-= 4) and assoc_resp_len (-= 6), both u8, with no lower\nbound. The aggregate check recently added to ath6kl_wmi_connect_event_rx()\nbounds the declared lengths from above (their sum must fit the received\nevent), but an assoc request/response shorter than its fixed offset still\nunderflows here: the u8 wraps to ~250, and cfg80211_connect_result() /\ncfg80211_roamed() then treat that wrapped value as the IE length and copy\nthat many bytes out of the small assoc_info buffer to user space via\nnl80211, disclosing adjacent slab memory.\n\nClamp both lengths to their offsets before subtracting.\n\nFound by 0sec (https://0sec.ai) using automated source analysis; the\nmissing lower bound is evident from source. Compile-tested."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - ath6kl is a fullMAC WiFi driver; assoc_req_len/assoc_resp_len come from a WMI_CONNECT_EVENT built from the 802.11 association exchange. A rogue or evil-twin AP, or a frame injector in radio range, supplies a truncated assoc/reassoc response, so the attacker must share the wireless segment.\nAC:L - A malicious AP can send a truncated association or reassociation response so firmware reports assoc_req_len \u003c 4 or assoc_resp_len \u003c 6. The u8 subtraction wraps deterministically and cfg80211 copies the wrapped length; the attacker can force (re)association or roaming with deauth until the event is emitted.\nPR:N - The WMI connect event is handled on the firmware receive path with no capability check, local account, or user-namespace gate. An adjacent attacker needs no privileges on the victim system.\nUI:N - Devices with a saved or open profile auto-associate, and the SME_CONNECTED roam path (cfg80211_roamed) delivers the same underflowed IEs while already connected, so no extra victim action is required.\nS:U - The out-of-bounds read, kernel-memory disclosure, and any resulting oops stay inside the host kernel\u0027s security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - After the u8 wrap, cfg80211_connect_result()/cfg80211_roamed() treat ~250-byte lengths as IE sizes and copy that many bytes from the small assoc_info skb into nl80211 CONNECT/ROAM events (and WEXT assoc IE events), disclosing adjacent slab memory far beyond a few bytes.\nI:N - The underflow only inflates the length used for an out-of-bounds read and copy to userspace; no kernel memory is written out of bounds and no attacker-controlled pointer is used to modify kernel state.\nA:H - Copying ~250 bytes past a short WMI skb can walk off the slab object into unmapped or redzoned memory, causing a kernel oops or KASAN panic that an adjacent attacker can retrigger by repeating association."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:00:40.689Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/225587bdbf4b0eb5265a71ee4dc183561a1857fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/d337213a889705a69735079606d0b4c672b17605"
        },
        {
          "url": "https://git.kernel.org/stable/c/e11d5ae96d5e52cb48fa27c6ad352d766d0322fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/6deb4d7a0c3d91821b2a8d5239e3d9933d9217d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/e3619bed5da125713b29ac881dc66f5e06606f88"
        },
        {
          "url": "https://git.kernel.org/stable/c/e1330d719c047c4d8190a16be034b29fc601a815"
        },
        {
          "url": "https://git.kernel.org/stable/c/8eb73016fb3968cf2db3987a92764563a3af773a"
        },
        {
          "url": "https://git.kernel.org/stable/c/3bbd05723d15dd06f0560bcd94fbf9a91b5f5613"
        }
      ],
      "title": "wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89524",
    "datePublished": "2026-09-11T19:44:05.548Z",
    "dateReserved": "2026-09-11T19:38:34.719Z",
    "dateUpdated": "2026-09-14T12:00:40.689Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89524",
      "date": "2026-09-17",
      "epss": "0.00277",
      "percentile": "0.20289"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89524\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:35.137\",\"lastModified\":\"2026-09-14T13:19:08.113\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets\\n\\nath6kl_cfg80211_connect_event() subtracts fixed IE offsets from\\nassoc_req_len (-= 4) and assoc_resp_len (-= 6), both u8, with no lower\\nbound. The aggregate check recently added to ath6kl_wmi_connect_event_rx()\\nbounds the declared lengths from above (their sum must fit the received\\nevent), but an assoc request/response shorter than its fixed offset still\\nunderflows here: the u8 wraps to ~250, and cfg80211_connect_result() /\\ncfg80211_roamed() then treat that wrapped value as the IE length and copy\\nthat many bytes out of the small assoc_info buffer to user space via\\nnl80211, disclosing adjacent slab memory.\\n\\nClamp both lengths to their offsets before subtracting.\\n\\nFound by 0sec (https://0sec.ai) using automated source analysis; the\\nmissing lower bound is evident from source. Compile-tested.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/wireless/ath/ath6kl/cfg80211.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"bdcd81707973cf8aa9305337166f8ee842a050d4\",\"lessThan\":\"225587bdbf4b0eb5265a71ee4dc183561a1857fc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bdcd81707973cf8aa9305337166f8ee842a050d4\",\"lessThan\":\"d337213a889705a69735079606d0b4c672b17605\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bdcd81707973cf8aa9305337166f8ee842a050d4\",\"lessThan\":\"e11d5ae96d5e52cb48fa27c6ad352d766d0322fb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bdcd81707973cf8aa9305337166f8ee842a050d4\",\"lessThan\":\"6deb4d7a0c3d91821b2a8d5239e3d9933d9217d9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bdcd81707973cf8aa9305337166f8ee842a050d4\",\"lessThan\":\"e3619bed5da125713b29ac881dc66f5e06606f88\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bdcd81707973cf8aa9305337166f8ee842a050d4\",\"lessThan\":\"e1330d719c047c4d8190a16be034b29fc601a815\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bdcd81707973cf8aa9305337166f8ee842a050d4\",\"lessThan\":\"8eb73016fb3968cf2db3987a92764563a3af773a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bdcd81707973cf8aa9305337166f8ee842a050d4\",\"lessThan\":\"3bbd05723d15dd06f0560bcd94fbf9a91b5f5613\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/wireless/ath/ath6kl/cfg80211.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.270\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.221\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.188\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/225587bdbf4b0eb5265a71ee4dc183561a1857fc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3bbd05723d15dd06f0560bcd94fbf9a91b5f5613\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6deb4d7a0c3d91821b2a8d5239e3d9933d9217d9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8eb73016fb3968cf2db3987a92764563a3af773a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d337213a889705a69735079606d0b4c672b17605\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e11d5ae96d5e52cb48fa27c6ad352d766d0322fb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e1330d719c047c4d8190a16be034b29fc601a815\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e3619bed5da125713b29ac881dc66f5e06606f88\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-16T12:14:01+00:00",
      "cve": "CVE-2026-89524",
      "id": "CVE-2026-89524",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_not_affected": "276",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89524.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:02:18Z",
      "cve": "CVE-2026-89524",
      "id": "CVE-2026-89524",
      "initial_release_date": "2026-09-12T16:26:51Z",
      "product_status:known_affected": "265",
      "product_status:known_not_affected": "88",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89524",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89524.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.