A vulnerability in multipath-tools (device-mapper-multipath) allows a local user to trigger an out-of-bounds read by sending a specially crafted command with a format string ending in a trailing percent character to the multipath daemon. This can lead to information disclosure or cause the daemon to crash, resulting in a denial of service. The issue affects versions prior to 0.9.5-22.oe2403sp3 and has been assigned CVE-2026-114038. A fix is available in version 0.9.5-22.oe2403sp3.