CVE-2026-114038Medium· 5.1▾ SunlitA flaw was found in device-mapper-multipath. A local user can trigger an out-of-bounds read by sending a command with a format string ending in a trailing percent character to the multipath daemon. This issue can allow the user to expose…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 28.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A flaw was found in device-mapper-multipath. A local user can trigger an out-of-bounds read by sending a command with a format string ending in a trailing percent character to the multipath daemon. This issue can allow the user to expose unintended daemon memory, leading to information disclosure, or cause the daemon to crash, resulting in a Denial of Service (DoS).
device-mapper-multipath (all versions)device-mapper-multipathdevice-mapper-multipath (all versions)device-mapper-multipath (all versions)device-mapper-multipath (all versions)openshift/ose-rhel-coreos-8 (all versions)openshift/ose-rhel-coreos-9 (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112260High· 7.1Gimp: gimp: heap out-of-bounds read in xcf text-layer parasite parsing
CVE-2026-98481Medium· 6.2kernel: nfc: port100: reject frames whose declared length exceeds the received data (CVE-2026-98481)
CVE-2026-98482Medium· 6.5kernel: nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() (CVE-2026-98482)
CVE-2026-98576Medium· 5.3kernel: nfc: llcp: fix slab-out-of-bounds reads when logging service names (CVE-2026-98576)
CVE-2026-98575Medium· 6.2kernel: nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() (CVE-2026-98575)
CVE-2026-98578Medium· 6.5kernel: nfc: st21nfca: validate ISO15693 inventory length (CVE-2026-98578)