A flaw was found in p11-kit. A local attacker, or one with equivalent access to a reachable RPC channel, could exploit an integer overflow… (CVE-2026-18938)
CVE-2026-18938 is an integer overflow vulnerability in p11-kit affecting 32-bit systems. A local attacker or one with equivalent RPC channel access can exploit this flaw by sending crafted messages that cause incorrect memory allocation for nested attributes. This leads to a heap out-of-bounds write and crashes the p11-kit RPC parsing process, resulting in a Denial of Service (DoS). No integrity or confidentiality impact is reported. The vulnerability has a CVSS score of 6.2 (medium severity).
AI Analysis
Technical Summary
The vulnerability in p11-kit involves an integer overflow during the calculation of attribute-array length in the RPC parsing process on 32-bit systems. This causes under-allocation of memory for nested attributes, leading to a heap-based buffer overflow (CWE-122). The overflow can cause a crash of the p11-kit RPC parsing process, resulting in a denial of service. Exploitation requires local access or equivalent access to a reachable RPC channel. There is no indication of remote exploitation without such access or of code execution. Red Hat's advisory confirms no patch or mitigation currently meets their criteria for ease of use, applicability, or stability.
Potential Impact
The primary impact is a denial of service due to a crash of the p11-kit RPC parsing process caused by heap out-of-bounds writes. There is no reported impact on confidentiality or integrity. The vulnerability is limited to 32-bit systems and requires local or equivalent RPC channel access. No known exploits are reported in the wild.
Mitigation Recommendations
According to the Red Hat advisory, no mitigation or patch currently meets their criteria for deployment or stability. Users should monitor vendor advisories for future updates. Since no official fix or mitigation is available, risk reduction may require limiting access to the RPC channel or using 64-bit systems where the vulnerability is not exploitable.
A flaw was found in p11-kit. A local attacker, or one with equivalent access to a reachable RPC channel, could exploit an integer overflow… (CVE-2026-18938)
Description
CVE-2026-18938 is an integer overflow vulnerability in p11-kit affecting 32-bit systems. A local attacker or one with equivalent RPC channel access can exploit this flaw by sending crafted messages that cause incorrect memory allocation for nested attributes. This leads to a heap out-of-bounds write and crashes the p11-kit RPC parsing process, resulting in a Denial of Service (DoS). No integrity or confidentiality impact is reported. The vulnerability has a CVSS score of 6.2 (medium severity).
CVSS v3.1
Score 6.2medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in p11-kit involves an integer overflow during the calculation of attribute-array length in the RPC parsing process on 32-bit systems. This causes under-allocation of memory for nested attributes, leading to a heap-based buffer overflow (CWE-122). The overflow can cause a crash of the p11-kit RPC parsing process, resulting in a denial of service. Exploitation requires local access or equivalent access to a reachable RPC channel. There is no indication of remote exploitation without such access or of code execution. Red Hat's advisory confirms no patch or mitigation currently meets their criteria for ease of use, applicability, or stability.
Potential Impact
The primary impact is a denial of service due to a crash of the p11-kit RPC parsing process caused by heap out-of-bounds writes. There is no reported impact on confidentiality or integrity. The vulnerability is limited to 32-bit systems and requires local or equivalent RPC channel access. No known exploits are reported in the wild.
Mitigation Recommendations
According to the Red Hat advisory, no mitigation or patch currently meets their criteria for deployment or stability. Users should monitor vendor advisories for future updates. Since no official fix or mitigation is available, risk reduction may require limiting access to the RPC channel or using 64-bit systems where the vulnerability is not exploitable.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-6x8p-h5fj-5ppr
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-18938"]
- Ecosystems
- []
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a75f716bf8831d5398500b1
Added to database: 08/07/2026, 15:17:42 UTC
Last enriched: 08/07/2026, 15:50:57 UTC
Last updated: 08/08/2026, 03:40:59 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.