GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89616 (GCVE-0-2026-89616)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:45 – Updated: 2026-09-14 12:01
VLAI
Title
fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()
Summary
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() ni_read_frame() decompresses an LZNT $DATA frame into the vmapped target pages and then trusts decompress_lznt()'s return value: unc_size = decompress_lznt(frame_ondisk, ondisk_size, frame_mem, frame_size); if ((ssize_t)unc_size < 0) err = unc_size; else if (!unc_size || unc_size > frame_size) err = -EINVAL; decompress_lznt() stops as soon as the compressed stream is exhausted (e.g. a zero chunk header) and returns the number of bytes it actually wrote, which may be far less than frame_size. The bytes between unc_size and frame_size are never written. The only memset() that follows zeroes the region beyond i_valid; when the frame lies entirely within the file's valid size that memset() does not run, so the gap retains whatever was in the just-vmapped pages. All pages are then marked uptodate and returned to userspace, disclosing uninitialized (recently-freed) kernel page memory. A crafted compressed file whose stream decompresses to only a few bytes leaks the remainder of every frame on a plain read(2), which is enough to recover kernel pointers and defeat KASLR. Zero the [unc_size, frame_size) tail immediately after a successful LZNT decompress so the remainder reads back as zero.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4342306f0f0d5ff4315a204d315c1b51b914fca5 , < 7d60a4c49af4d5cb88aa7cbf998d0408bd415055 (git)
Affected: 4342306f0f0d5ff4315a204d315c1b51b914fca5 , < cd40eee4923d104ebec9ac7513b971bc441e431d (git)
Affected: 4342306f0f0d5ff4315a204d315c1b51b914fca5 , < 77d8efd04745cda23858546afdbd9d07b591758e (git)
Affected: 4342306f0f0d5ff4315a204d315c1b51b914fca5 , < 0f699ddb290a24b37e1bc9bf1e3c9dbccf564bea (git)
Affected: 4342306f0f0d5ff4315a204d315c1b51b914fca5 , < 376ee45659a4b943df672ad275c63da00655f929 (git)
Affected: 4342306f0f0d5ff4315a204d315c1b51b914fca5 , < 4a1b39b2e10eb8de86265e80cf2be4396bc1dce4 (git)
Affected: 4342306f0f0d5ff4315a204d315c1b51b914fca5 , < 35d1ea92c7d946e2ebdbe36cdb2c969c8704bebd (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/frecord.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7d60a4c49af4d5cb88aa7cbf998d0408bd415055",
              "status": "affected",
              "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5",
              "versionType": "git"
            },
            {
              "lessThan": "cd40eee4923d104ebec9ac7513b971bc441e431d",
              "status": "affected",
              "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5",
              "versionType": "git"
            },
            {
              "lessThan": "77d8efd04745cda23858546afdbd9d07b591758e",
              "status": "affected",
              "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5",
              "versionType": "git"
            },
            {
              "lessThan": "0f699ddb290a24b37e1bc9bf1e3c9dbccf564bea",
              "status": "affected",
              "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5",
              "versionType": "git"
            },
            {
              "lessThan": "376ee45659a4b943df672ad275c63da00655f929",
              "status": "affected",
              "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5",
              "versionType": "git"
            },
            {
              "lessThan": "4a1b39b2e10eb8de86265e80cf2be4396bc1dce4",
              "status": "affected",
              "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5",
              "versionType": "git"
            },
            {
              "lessThan": "35d1ea92c7d946e2ebdbe36cdb2c969c8704bebd",
              "status": "affected",
              "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/frecord.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()\n\nni_read_frame() decompresses an LZNT $DATA frame into the vmapped target\npages and then trusts decompress_lznt()\u0027s return value:\n\n  unc_size = decompress_lznt(frame_ondisk, ondisk_size, frame_mem,\n                             frame_size);\n  if ((ssize_t)unc_size \u003c 0)        err = unc_size;\n  else if (!unc_size || unc_size \u003e frame_size)  err = -EINVAL;\n\ndecompress_lznt() stops as soon as the compressed stream is exhausted\n(e.g. a zero chunk header) and returns the number of bytes it actually\nwrote, which may be far less than frame_size. The bytes between unc_size\nand frame_size are never written. The only memset() that follows zeroes\nthe region beyond i_valid; when the frame lies entirely within the file\u0027s\nvalid size that memset() does not run, so the gap retains whatever was in\nthe just-vmapped pages. All pages are then marked uptodate and returned\nto userspace, disclosing uninitialized (recently-freed) kernel page\nmemory. A crafted compressed file whose stream decompresses to only a few\nbytes leaks the remainder of every frame on a plain read(2), which is\nenough to recover kernel pointers and defeat KASLR.\n\nZero the [unc_size, frame_size) tail immediately after a successful LZNT\ndecompress so the remainder reads back as zero."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - ni_read_frame() runs from ntfs_read_folio on LZNT-compressed reads. ntfs3 registers export_operations, so ksmbd/nfsd vfs_read and splice on an exported NTFS volume reach this path and return leaked page-cache bytes to a remote SMB/NFS client on NAS and hybrid file-server deployments.\nAC:L - A crafted NTFS image fully controls the on-disk LZNT stream; a zero chunk header makes decompress_lznt() return far fewer than frame_size bytes deterministically, with no race, rare config, or attacker-uncontrollable memory layout required.\nPR:N - A remote client can trigger the leak by reading a world-readable compressed file over NFS (AUTH_SYS/guest) or a ksmbd guest share with no local account or capability on the host; ntfs3 file-read paths check only inode state, not privileges.\nUI:N - After the NTFS volume is mounted and exported\u2014the normal state for NAS, dual-boot, and automounted removable NTFS\u2014the attacker only issues reads; no further victim action such as opening a file or confirming a prompt is required.\nS:U - The leak exposes the host kernel\u0027s own freed page contents through that kernel\u0027s page cache to the reader and does not cross a VM, guest-to-host, IOMMU, or other security-authority boundary.\nC:H - Each crafted frame can disclose up to the uncompressed LZNT unit (typically 64KiB) of uninitialized recently-freed kernel page memory, repeatable across the file, including kernel pointers for KASLR bypass and residual secrets rather than a small bounded read.\nI:N - The defect only leaves the decompressed-frame tail unzeroed in the file\u0027s own page-cache pages; it does not perform an out-of-bounds write, corrupt kernel objects, or yield a write or control-flow hijack primitive.\nA:N - Partial LZNT decompress is treated as success; pages are marked uptodate and the read returns data without a kernel oops, panic, hang, deadlock, or other availability loss."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:01:32.105Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7d60a4c49af4d5cb88aa7cbf998d0408bd415055"
        },
        {
          "url": "https://git.kernel.org/stable/c/cd40eee4923d104ebec9ac7513b971bc441e431d"
        },
        {
          "url": "https://git.kernel.org/stable/c/77d8efd04745cda23858546afdbd9d07b591758e"
        },
        {
          "url": "https://git.kernel.org/stable/c/0f699ddb290a24b37e1bc9bf1e3c9dbccf564bea"
        },
        {
          "url": "https://git.kernel.org/stable/c/376ee45659a4b943df672ad275c63da00655f929"
        },
        {
          "url": "https://git.kernel.org/stable/c/4a1b39b2e10eb8de86265e80cf2be4396bc1dce4"
        },
        {
          "url": "https://git.kernel.org/stable/c/35d1ea92c7d946e2ebdbe36cdb2c969c8704bebd"
        }
      ],
      "title": "fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89616",
    "datePublished": "2026-09-11T19:45:16.064Z",
    "dateReserved": "2026-09-11T19:38:34.735Z",
    "dateUpdated": "2026-09-14T12:01:32.105Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89616",
      "date": "2026-09-16",
      "epss": "0.00415",
      "percentile": "0.35226"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-15T01:52:28.000Z",
      "cve": "CVE-2026-89616",
      "id": "msrc_CVE-2026-89616",
      "initial_release_date": "2026-09-13T01:13:18.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89616.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89616\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:46.783\",\"lastModified\":\"2026-09-14T13:19:15.547\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()\\n\\nni_read_frame() decompresses an LZNT $DATA frame into the vmapped target\\npages and then trusts decompress_lznt()\u0027s return value:\\n\\n  unc_size = decompress_lznt(frame_ondisk, ondisk_size, frame_mem,\\n                             frame_size);\\n  if ((ssize_t)unc_size \u003c 0)        err = unc_size;\\n  else if (!unc_size || unc_size \u003e frame_size)  err = -EINVAL;\\n\\ndecompress_lznt() stops as soon as the compressed stream is exhausted\\n(e.g. a zero chunk header) and returns the number of bytes it actually\\nwrote, which may be far less than frame_size. The bytes between unc_size\\nand frame_size are never written. The only memset() that follows zeroes\\nthe region beyond i_valid; when the frame lies entirely within the file\u0027s\\nvalid size that memset() does not run, so the gap retains whatever was in\\nthe just-vmapped pages. All pages are then marked uptodate and returned\\nto userspace, disclosing uninitialized (recently-freed) kernel page\\nmemory. A crafted compressed file whose stream decompresses to only a few\\nbytes leaks the remainder of every frame on a plain read(2), which is\\nenough to recover kernel pointers and defeat KASLR.\\n\\nZero the [unc_size, frame_size) tail immediately after a successful LZNT\\ndecompress so the remainder reads back as zero.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/ntfs3/frecord.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4342306f0f0d5ff4315a204d315c1b51b914fca5\",\"lessThan\":\"7d60a4c49af4d5cb88aa7cbf998d0408bd415055\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4342306f0f0d5ff4315a204d315c1b51b914fca5\",\"lessThan\":\"cd40eee4923d104ebec9ac7513b971bc441e431d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4342306f0f0d5ff4315a204d315c1b51b914fca5\",\"lessThan\":\"77d8efd04745cda23858546afdbd9d07b591758e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4342306f0f0d5ff4315a204d315c1b51b914fca5\",\"lessThan\":\"0f699ddb290a24b37e1bc9bf1e3c9dbccf564bea\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4342306f0f0d5ff4315a204d315c1b51b914fca5\",\"lessThan\":\"376ee45659a4b943df672ad275c63da00655f929\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4342306f0f0d5ff4315a204d315c1b51b914fca5\",\"lessThan\":\"4a1b39b2e10eb8de86265e80cf2be4396bc1dce4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4342306f0f0d5ff4315a204d315c1b51b914fca5\",\"lessThan\":\"35d1ea92c7d946e2ebdbe36cdb2c969c8704bebd\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/ntfs3/frecord.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.221\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.188\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0f699ddb290a24b37e1bc9bf1e3c9dbccf564bea\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/35d1ea92c7d946e2ebdbe36cdb2c969c8704bebd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/376ee45659a4b943df672ad275c63da00655f929\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4a1b39b2e10eb8de86265e80cf2be4396bc1dce4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/77d8efd04745cda23858546afdbd9d07b591758e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7d60a4c49af4d5cb88aa7cbf998d0408bd415055\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cd40eee4923d104ebec9ac7513b971bc441e431d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T06:59:24+00:00",
      "cve": "CVE-2026-89616",
      "id": "CVE-2026-89616",
      "initial_release_date": "2026-09-11T19:45:16.064000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Information leak in NTFS3 filesystem due to partial LZNT decompression",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89616.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:01:37Z",
      "cve": "CVE-2026-89616",
      "id": "CVE-2026-89616",
      "initial_release_date": "2026-09-16T00:01:37Z",
      "product_status:known_affected": "114",
      "product_status:known_not_affected": "239",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89616",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89616.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.