CVE-2026-107446: CWE-190 Integer Overflow or Wraparound in containerd overlaybd

The vulnerability CVE-2026-107446 affects containerd overlaybd through version 1.0.18. It is caused by an integer overflow in the do_load_index function responsible for loading LSMT indexes. When an untrusted overlaybd blob from a registry is used in scenarios involving multiple overlaybd-backed containers, the integer overflow on index_bytes can lead to out-of-bounds heap access. This can result in denial of service by impacting the availability of the affected system. The CVSS 3.1 base score is 6.8, reflecting a network attack vector with high attack complexity and no privileges or user interaction required, but with impact limited to availability.

Successful exploitation of this vulnerability can cause out-of-bounds heap access, potentially leading to denial of service conditions affecting the availability of containerd overlaybd services. There is no indication of confidentiality or integrity impact. No known exploits are reported in the wild.

No explicit patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using untrusted overlaybd blobs from registries in environments with multiple overlaybd-backed containers to reduce risk.