Red HatCVE-2026-93433
Red Hat libstoragemgmt: buffer overflow
Medium5.5CVE-2026-93433 · Published Sep 21, 2026 · updated Sep 24, 2026
A flaw was found in libstoragemgmt. An attacker with control over a local or virtual storage device could provide specially crafted SCSI (Small Computer System Interface) Vital Product Data (VPD) page 0x80 data. This malformed data, specifically an untrusted page length field, can lead to a stack buffer overflow in the `_sg_parse_vpd_80()` function during serial number parsing. Successful exploitation could result in a denial of service by crashing or destabilizing the process querying the serial number.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 10 Product | all versions | No fix yet |
| Red Hat Enterprise Linux 7 Product | all versions | No fix yet |
| Red Hat Enterprise Linux 8 Product | all versions | No fix yet |
| Red Hat Enterprise Linux 9 Product | all versions | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-121
More Red Hat advisories
All Red Hat| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 21 | usbredir: out-of-bounds write | Medium4.1 | No fix yet |
| Sep 21 | Red Hat SmallRye Fault Tolerance: resource exhaustion | High7.5 | No fix yet |
| Sep 21 | Red Hat fetchmail: stack buffer overflow | High8.1 | No fix yet |
| Sep 21 | Red Hat pki-core: improper authorization | High8.1 | No fix yet |
| Sep 21 | Red Hat OpenShift Container Platform 4: improper signature check | High7.4 | No fix yet |
| Sep 21 | Red Hat Openshift Data Foundation 4: improper signature check | High7.1 | No fix yet |