Out-of-bounds write in libsaviextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory. (CVE-2026-21090)
Source GCVE Database
No CVSS score published yet
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 0% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XWhat to do
AI-suggested
A fix is available in SMR Sep-2026 Release 1. Users should update to this release to remediate the vulnerability. No additional mitigation guidance is provided or required.
Description
An out-of-bounds write vulnerability exists in libsaviextractor.so prior to SMR Sep-2026 Release 1. This flaw allows local attackers with low privileges to write memory outside intended bounds, potentially causing memory corruption. No known exploits are reported in the wild. The severity is assessed as medium based on available information.
Impact
Successful exploitation could result in memory corruption, which might cause application instability or potentially allow further local privilege escalation or code execution. However, exploitation requires local access and low privileges, limiting the attack surface. No active exploits are known.
Summary
CVE-2026-21090 describes an out-of-bounds write vulnerability in the shared library libsaviextractor.so affecting versions prior to SMR Sep-2026 Release 1. The vulnerability permits local attackers with low privileges to write outside the allocated memory bounds, which may lead to memory corruption. Exploitation requires local access and no user interaction. There are no reports of active exploitation in the wild. The vulnerability is classified as medium severity.