CVE-2026-64558 (GCVE-0-2026-64558)
Vulnerability from cvelistv5 – Published: 2026-07-29 16:31 – Updated: 2026-10-19 20:48
VLAI
EPSS
VEX
Title
s390/pkey: Check length in pkey_pckmo handler implementation
Summary
In the Linux kernel, the following vulnerability has been resolved:
s390/pkey: Check length in pkey_pckmo handler implementation
Explicitly check the length of the target buffer in the pkey_pckmo
implementation of the key_to_protkey() handler function. The handler
function fails, if the generated output data exceeds the length of the
provided target buffer.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 15:42 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
8fcc231ce3bea12b78bb94b280cdc03cff342435 , < 02028a24e26d85262ab9c8fc4344e1f3503007fc
(git)
Affected: 8fcc231ce3bea12b78bb94b280cdc03cff342435 , < 433e5e70cdc1edf382d28d08a885b22e2b98b7da (git) Affected: 8fcc231ce3bea12b78bb94b280cdc03cff342435 , < 614aa0491c7a190556c2345dddee0b6f5ed90989 (git) Affected: 8fcc231ce3bea12b78bb94b280cdc03cff342435 , < 1ac287e2af9a9112fe271427ef45eceb26bce8b4 (git) |
guessed | |
| Linux | Linux |
Affected:
6.12
Unaffected: 0 , < 6.12 (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64558",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:42:40.566840Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:48:41.175Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/s390/crypto/pkey_pckmo.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "02028a24e26d85262ab9c8fc4344e1f3503007fc",
"status": "affected",
"version": "8fcc231ce3bea12b78bb94b280cdc03cff342435",
"versionType": "git"
},
{
"lessThan": "433e5e70cdc1edf382d28d08a885b22e2b98b7da",
"status": "affected",
"version": "8fcc231ce3bea12b78bb94b280cdc03cff342435",
"versionType": "git"
},
{
"lessThan": "614aa0491c7a190556c2345dddee0b6f5ed90989",
"status": "affected",
"version": "8fcc231ce3bea12b78bb94b280cdc03cff342435",
"versionType": "git"
},
{
"lessThan": "1ac287e2af9a9112fe271427ef45eceb26bce8b4",
"status": "affected",
"version": "8fcc231ce3bea12b78bb94b280cdc03cff342435",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/s390/crypto/pkey_pckmo.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/pkey: Check length in pkey_pckmo handler implementation\n\nExplicitly check the length of the target buffer in the pkey_pckmo\nimplementation of the key_to_protkey() handler function. The handler\nfunction fails, if the generated output data exceeds the length of the\nprovided target buffer."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is entered through the PKEY_KBLOB2PROTK/PKEY_KBLOB2PROTK2 ioctls on the /dev/pkey character device, or via an AF_ALG setkey on the paes skciphers. Both require local system access; no network input reaches this code.\nAC:L - A single ioctl with a hand-crafted 176-byte protected-key token (type 0x00, version TOKVER_PROTECTED_KEY, keytype PKEY_KEYTYPE_HMAC_1024, len 160) deterministically triggers the 96-byte overflow; there is no race, no memory-layout dependency, and no hardware or wrapping-key prerequisite since the non-AES branch skips pckmo_verify_protkey().\nPR:L - /dev/pkey is registered as a miscdevice with .mode = 0666 and pkey_unlocked_ioctl() contains no capability or permission check, so any unprivileged local user can reach the bug; the paes/AF_ALG setkey path likewise requires no privileges.\nUI:N - The attacker triggers the overflow entirely on their own via a single ioctl or socket option call; no victim action, mount, or file open is involved.\nS:U - The corruption is confined to the kernel\u0027s own stack within the same security authority; exploitation yields kernel privilege escalation rather than crossing a VM, IOMMU, or sandbox boundary.\nC:H - The attacker gains a fully controlled 96-byte out-of-bounds stack write that can clobber adjacent locals, saved pointers and return addresses, which is readily leveraged into arbitrary kernel memory disclosure; the copy also leaves *protkeylen inflated to 160 while the buffer is 64 bytes, feeding an oversized length back to callers.\nI:H - This is an out-of-bounds write of 96 attacker-chosen bytes past the end of a kernel stack object (the last member of struct pkey_kblob2pkey), overwriting saved registers and the return address \u2014 a classic control-flow hijack / local privilege escalation primitive.\nA:H - Smashing the kernel stack past the canary reliably produces a stack-protector panic or an oops on return, and any unprivileged user can repeat it at will to crash the machine."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:57:36.699Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/02028a24e26d85262ab9c8fc4344e1f3503007fc"
},
{
"url": "https://git.kernel.org/stable/c/433e5e70cdc1edf382d28d08a885b22e2b98b7da"
},
{
"url": "https://git.kernel.org/stable/c/614aa0491c7a190556c2345dddee0b6f5ed90989"
},
{
"url": "https://git.kernel.org/stable/c/1ac287e2af9a9112fe271427ef45eceb26bce8b4"
}
],
"title": "s390/pkey: Check length in pkey_pckmo handler implementation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64558",
"datePublished": "2026-07-29T16:31:21.591Z",
"dateReserved": "2026-07-19T15:36:31.796Z",
"dateUpdated": "2026-10-19T20:48:41.175Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-64558",
"date": "2026-11-10",
"epss": "0.0012",
"percentile": "0.01857"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/s390/crypto/pkey_pckmo.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "02028a24e26d85262ab9c8fc4344e1f3503007fc",
"status": "affected",
"version": "8fcc231ce3bea12b78bb94b280cdc03cff342435",
"versionType": "git"
},
{
"lessThan": "433e5e70cdc1edf382d28d08a885b22e2b98b7da",
"status": "affected",
"version": "8fcc231ce3bea12b78bb94b280cdc03cff342435",
"versionType": "git"
},
{
"lessThan": "614aa0491c7a190556c2345dddee0b6f5ed90989",
"status": "affected",
"version": "8fcc231ce3bea12b78bb94b280cdc03cff342435",
"versionType": "git"
},
{
"lessThan": "1ac287e2af9a9112fe271427ef45eceb26bce8b4",
"status": "affected",
"version": "8fcc231ce3bea12b78bb94b280cdc03cff342435",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/s390/crypto/pkey_pckmo.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/pkey: Check length in pkey_pckmo handler implementation\n\nExplicitly check the length of the target buffer in the pkey_pckmo\nimplementation of the key_to_protkey() handler function. The handler\nfunction fails, if the generated output data exceeds the length of the\nprovided target buffer."
}
],
"id": "CVE-2026-64558",
"lastModified": "2026-11-03T18:15:39.353",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-64558",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:42:40.566840Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-07-29T17:16:53.410",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/02028a24e26d85262ab9c8fc4344e1f3503007fc"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/1ac287e2af9a9112fe271427ef45eceb26bce8b4"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/433e5e70cdc1edf382d28d08a885b22e2b98b7da"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/614aa0491c7a190556c2345dddee0b6f5ed90989"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-122"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
},
"redhat_vex": {
"aggregate_severity": "Important",
"current_release_date": "2026-11-04T22:56:02+00:00",
"cve": "CVE-2026-64558",
"id": "CVE-2026-64558",
"initial_release_date": "2026-07-29T00:00:00+00:00",
"product_status:fixed": "305",
"product_status:known_affected": "108",
"product_status:known_not_affected": "92",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: s390/pkey: Check length in pkey_pckmo handler implementation",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64558.json",
"version": "3"
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64558",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:42:40.566840Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T15:42:41.657Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/s390/crypto/pkey_pckmo.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "02028a24e26d85262ab9c8fc4344e1f3503007fc",
"status": "affected",
"version": "8fcc231ce3bea12b78bb94b280cdc03cff342435",
"versionType": "git"
},
{
"lessThan": "433e5e70cdc1edf382d28d08a885b22e2b98b7da",
"status": "affected",
"version": "8fcc231ce3bea12b78bb94b280cdc03cff342435",
"versionType": "git"
},
{
"lessThan": "614aa0491c7a190556c2345dddee0b6f5ed90989",
"status": "affected",
"version": "8fcc231ce3bea12b78bb94b280cdc03cff342435",
"versionType": "git"
},
{
"lessThan": "1ac287e2af9a9112fe271427ef45eceb26bce8b4",
"status": "affected",
"version": "8fcc231ce3bea12b78bb94b280cdc03cff342435",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/s390/crypto/pkey_pckmo.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/pkey: Check length in pkey_pckmo handler implementation\n\nExplicitly check the length of the target buffer in the pkey_pckmo\nimplementation of the key_to_protkey() handler function. The handler\nfunction fails, if the generated output data exceeds the length of the\nprovided target buffer."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is entered through the PKEY_KBLOB2PROTK/PKEY_KBLOB2PROTK2 ioctls on the /dev/pkey character device, or via an AF_ALG setkey on the paes skciphers. Both require local system access; no network input reaches this code.\nAC:L - A single ioctl with a hand-crafted 176-byte protected-key token (type 0x00, version TOKVER_PROTECTED_KEY, keytype PKEY_KEYTYPE_HMAC_1024, len 160) deterministically triggers the 96-byte overflow; there is no race, no memory-layout dependency, and no hardware or wrapping-key prerequisite since the non-AES branch skips pckmo_verify_protkey().\nPR:L - /dev/pkey is registered as a miscdevice with .mode = 0666 and pkey_unlocked_ioctl() contains no capability or permission check, so any unprivileged local user can reach the bug; the paes/AF_ALG setkey path likewise requires no privileges.\nUI:N - The attacker triggers the overflow entirely on their own via a single ioctl or socket option call; no victim action, mount, or file open is involved.\nS:U - The corruption is confined to the kernel\u0027s own stack within the same security authority; exploitation yields kernel privilege escalation rather than crossing a VM, IOMMU, or sandbox boundary.\nC:H - The attacker gains a fully controlled 96-byte out-of-bounds stack write that can clobber adjacent locals, saved pointers and return addresses, which is readily leveraged into arbitrary kernel memory disclosure; the copy also leaves *protkeylen inflated to 160 while the buffer is 64 bytes, feeding an oversized length back to callers.\nI:H - This is an out-of-bounds write of 96 attacker-chosen bytes past the end of a kernel stack object (the last member of struct pkey_kblob2pkey), overwriting saved registers and the return address \u2014 a classic control-flow hijack / local privilege escalation primitive.\nA:H - Smashing the kernel stack past the canary reliably produces a stack-protector panic or an oops on return, and any unprivileged user can repeat it at will to crash the machine."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:57:36.699Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/02028a24e26d85262ab9c8fc4344e1f3503007fc"
},
{
"url": "https://git.kernel.org/stable/c/433e5e70cdc1edf382d28d08a885b22e2b98b7da"
},
{
"url": "https://git.kernel.org/stable/c/614aa0491c7a190556c2345dddee0b6f5ed90989"
},
{
"url": "https://git.kernel.org/stable/c/1ac287e2af9a9112fe271427ef45eceb26bce8b4"
}
],
"title": "s390/pkey: Check length in pkey_pckmo handler implementation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64558",
"datePublished": "2026-07-29T16:31:21.591Z",
"dateReserved": "2026-07-19T15:36:31.796Z",
"dateUpdated": "2026-10-19T20:48:41.175Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.