CVE-2026-89999: Software Security Vulnerability Vulnerability

HIGH
Advisory Identifier: GHSA-4g38-8hm5-638j
Share
CVSS 8.1
Published
Advisory Summary

CVE-2026-89999 is a HIGH (CVSS 8.1) security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-89999 at a Glance

CVE Identifier CVE-2026-89999
GHSA Identifier GHSA-4g38-8hm5-638j
Severity HIGH
CVSS v3.1 Base Score 8.1
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 8.1

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).

Attack Vector Adjacent (AV:A)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity None (I:N)
Availability High (A:H)

How to Fix CVE-2026-89999

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-89999, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: validate report length in wacom_intuos_pro2_bt_irq wacom_intuos_pro2_bt_irq() receives the wire report length in `len` but never consults it before parsing. After the report-id gate it unconditionally calls wacom_intuos_pro2_bt_pen() and then, selected by features.type, a fixed chain of sub-parsers, none of which receive `len`: wacom_intuos_pro2_bt_pen(wacom); if (type == INTUOSP2_BT || type == INTUOSP2S_BT) { wacom_intuos_pro2_bt_touch(wacom); wacom_intuos_pro2_bt_pad(wacom); wacom_intuos_pro2_bt_battery(wacom); } else { wacom_intuos_gen3_bt_pad(wacom); wacom_intuos_gen3_bt_battery(wacom); } Each sub-parser dereferences wacom->data at fixed offsets. The furthest byte touched on each branch is: INTUOSP2_BT / INTUOSP2S_BT: wacom_intuos_pro2_bt_pad() reads data[285] (the touchring byte), so the report must be at least 286 bytes; INTUOSHT3_BT ("gen3"): wacom_intuos_gen3_bt_battery() reads data[45], so the report must be at least 46 bytes. features.type is selected from the VID/PID id_table entry and wacom_setup_device_quirks() force-registers the pen/pad/touch inputs for that type independent of the report descriptor, so a malicious or malfunctioning paired/spoofed Bluetooth peripheral can advertise that VID/PID and send an undersized report that still satisfies the data[0] == 0x80/0x81 gate. The driver then reads past the received report and forwards the bytes to userspace via evdev (MSC_SERIAL / ABS_MISC / ABS_WHEEL on the pen and pad input nodes), an out-of-bounds read with a concrete userspace read-back channel, and a true out-of-bounds read on transports whose backing buffer is sized to the (small) report descriptor rather than a fixed-size staging buffer. This is the same class of bug commit 2f1763f62909 ("HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq") already hardened in the sibling wacom_intuos_bt_irq(), which guards each report id against its minimum length before parsing. Guard wacom_intuos_pro2_bt_irq() the same way: before parsing, reject reports shorter than the furthest offset the selected branch actually dereferences, warn, and bail out. Because the whole pen/touch/pad/ battery chain runs unconditionally per branch, a single up-front check against the maximum offset (286 bytes for INTUOSP2_BT/INTUOSP2S_BT, 46 bytes for the gen3 branch) bounds every sub-parser. Returning 0 on a short report also skips those calls for the same malformed report, which is the safe, conservative behavior.

References

NVD — CVE-2026-89999 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-89999
git.kernel.org/stable/c/0cdc6cb242... WEB
https://git.kernel.org/stable/c/0cdc6cb242dd8d2731956fdf3390de094482a4b2
git.kernel.org/stable/c/114af803e4... WEB
https://git.kernel.org/stable/c/114af803e409a68e52516810ecd24df4d8ce0c68
git.kernel.org/stable/c/1bfc0547b8... WEB
https://git.kernel.org/stable/c/1bfc0547b81d5861443420d19b5ed2fd533cd17f
git.kernel.org/stable/c/74ec08f7b8... WEB
https://git.kernel.org/stable/c/74ec08f7b81c2726578039ca6dea0fec136c38ea
git.kernel.org/stable/c/84781a1f3c... WEB
https://git.kernel.org/stable/c/84781a1f3c5dc6650480be9329e6e8528939eaa0
git.kernel.org/stable/c/96dd0af759... WEB
https://git.kernel.org/stable/c/96dd0af7597aba2d80cc97e2f66e8b72d30ba125
git.kernel.org/stable/c/a8e04f3f89... WEB
https://git.kernel.org/stable/c/a8e04f3f894ccb52cfcd7e60125a9f35da4a616d
git.kernel.org/stable/c/d2844f3fcd... WEB
https://git.kernel.org/stable/c/d2844f3fcd058113acbe0aa110ab13ef28b98d9f

Frequently Asked Questions

What is CVE-2026-89999?
CVE-2026-89999 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-89999?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-89999?
CVE-2026-89999 has a CVSS v3.1 base score of 8.1 (HIGH) with vector string CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H.
What CWE is associated with CVE-2026-89999?
CVE-2026-89999 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-89999?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-4g38-8hm5-638j",
  "modified" : "2026-09-16T15:31:06Z",
  "published" : "2026-09-16T12:30:44Z",
  "aliases" : [ "CVE-2026-89999" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: wacom: validate report length in wacom_intuos_pro2_bt_irq\n\nwacom_intuos_pro2_bt_irq() receives the wire report length in `len`\nbut never consults it before parsing. After the report-id gate it\nunconditionally calls wacom_intuos_pro2_bt_pen() and then, selected by\nfeatures.type, a fixed chain of sub-parsers, none of which receive\n`len`:\n\n\twacom_intuos_pro2_bt_pen(wacom);\n\tif (type == INTUOSP2_BT || type == INTUOSP2S_BT) {\n\t\twacom_intuos_pro2_bt_touch(wacom);\n\t\twacom_intuos_pro2_bt_pad(wacom);\n\t\twacom_intuos_pro2_bt_battery(wacom);\n\t} else {\n\t\twacom_intuos_gen3_bt_pad(wacom);\n\t\twacom_intuos_gen3_bt_battery(wacom);\n\t}\n\nEach sub-parser dereferences wacom->data at fixed offsets. The furthest\nbyte touched on each branch is:\n\n  INTUOSP2_BT / INTUOSP2S_BT: wacom_intuos_pro2_bt_pad() reads data[285]\n\t(the touchring byte), so the report must be at least 286 bytes;\n  INTUOSHT3_BT (\"gen3\"): wacom_intuos_gen3_bt_battery() reads data[45],\n\tso the report must be at least 46 bytes.\n\nfeatures.type is selected from the VID/PID id_table entry and\nwacom_setup_device_quirks() force-registers the pen/pad/touch inputs\nfor that type independent of the report descriptor, so a malicious or\nmalfunctioning paired/spoofed Bluetooth peripheral can advertise that\nVID/PID and send an undersized report that still satisfies the\ndata[0] == 0x80/0x81 gate. The driver then reads past the received\nreport and forwards the bytes to userspace via evdev (MSC_SERIAL /\nABS_MISC / ABS_WHEEL on the pen and pad input nodes), an out-of-bounds\nread with a concrete userspace read-back channel, and a true\nout-of-bounds read on transports whose backing buffer is sized to the\n(small) report descriptor rather than a fixed-size staging buffer.\n\nThis is the same class of bug commit 2f1763f62909 (\"HID: wacom: fix\nout-of-bounds read in wacom_intuos_bt_irq\") already hardened in the\nsibling wacom_intuos_bt_irq(), which guards each report id against its\nminimum length before parsing.\n\nGuard wacom_intuos_pro2_bt_irq() the same way: before parsing, reject\nreports shorter than the furthest offset the selected branch actually\ndereferences, warn, and bail out. Because the whole pen/touch/pad/\nbattery chain runs unconditionally per branch, a single up-front check\nagainst the maximum offset (286 bytes for INTUOSP2_BT/INTUOSP2S_BT,\n46 bytes for the gen3 branch) bounds every sub-parser. Returning 0 on\na short report also skips those calls for the same malformed report,\nwhich is the safe, conservative behavior.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-89999"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/0cdc6cb242dd8d2731956fdf3390de094482a4b2"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/114af803e409a68e52516810ecd24df4d8ce0c68"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/1bfc0547b81d5861443420d19b5ed2fd533cd17f"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/74ec08f7b81c2726578039ca6dea0fec136c38ea"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/84781a1f3c5dc6650480be9329e6e8528939eaa0"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/96dd0af7597aba2d80cc97e2f66e8b72d30ba125"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/a8e04f3f894ccb52cfcd7e60125a9f35da4a616d"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/d2844f3fcd058113acbe0aa110ab13ef28b98d9f"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "HIGH",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-09-16T11:17:11Z"
  }
}