A vulnerability in multipath-tools (device-mapper-multipath) allows a local user to cause an out-of-bounds read by sending a specially crafted command with a format string ending in a trailing percent character to the multipath daemon. This can lead to information disclosure or cause the daemon to crash, resulting in a denial of service. The issue affects versions prior to 0.9.5-22.oe2403sp1 and has been assigned CVE-2026-114038. A patch is available in version 0.9.5-22.oe2403sp1.