CVE-2026-114038: Out-of-bounds Read in Red Hat Red Hat Enterprise Linux 10

This vulnerability in device-mapper-multipath allows a local user to trigger an out-of-bounds read by providing a command with a format string that ends with a trailing percent character to the multipath daemon. The flaw can expose unintended daemon memory, leading to information disclosure, or cause the daemon to crash, resulting in denial of service. The CVSS 3.1 base score is 5.1, reflecting a medium severity with local attack vector, low complexity, no privileges required, no user interaction, and impact on confidentiality and availability only.

Successful exploitation can disclose unintended memory contents of the multipath daemon, potentially leaking sensitive information. Additionally, it can cause the daemon to crash, resulting in denial of service. There is no indication of integrity impact. The attack requires local access and no privileges, making it moderately accessible but limited to local users.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-114038 for current remediation guidance. Until a patch is applied, restrict local user access to the multipath daemon and monitor for unusual daemon crashes.