CVE-2026-64432: Software Security Vulnerability Vulnerability

HIGH
Advisory Identifier: GHSA-4xg7-26qr-mccf
Share
CVSS 7.8
CWE-787
Published
Advisory Summary

CVE-2026-64432 is a HIGH (CVSS 7.8) security vulnerability vulnerability (CWE-787: Out-of-bounds Write) affecting Software libraries in the Maven ecosystem. The weakness occurs when the product writes data past the end, or before the beginning, of the intended buffer.. Remediation is available in the latest vendor maintenance releases.

CVE-2026-64432 at a Glance

CVE Identifier CVE-2026-64432
GHSA Identifier GHSA-4xg7-26qr-mccf
Severity HIGH
CVSS v3.1 Base Score 7.8
CWE Classification CWE-787: Out-of-bounds Write
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 7.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

Attack Vector Local (AV:L)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction Required (UI:R)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability High (A:H)

How to Fix CVE-2026-64432

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-64432, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-787: Out-of-bounds Write, where the product writes data past the end, or before the beginning, of the intended buffer. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns In the analysis pass of $LogFile journal replay, log_replay() copies LCNs from each action log record into an existing Dirty Page Table (DPT) entry without bounding the destination index. A crafted NTFS image with DPT entry lcns_follow=1 and an action log record with lcns_follow=2 produces a kernel slab out-of-bounds write at mount time: BUG: KASAN: slab-out-of-bounds in log_replay+0x654c/0xdb60 Write of size 8 at addr ffff8880095e1040 by task mount Two attacker-controlled fields can drive j+i past the allocated page_lcns[] array: 1. dp->lcns_follow (capacity) can be smaller than lrh->lcns_follow. 2. lrh->target_vcn may be smaller than dp->vcn, making the u64 subtraction wrap to a huge size_t. Validate target VCN delta and per-record LCN count against the DPT entry capacity, bail via the existing out: cleanup label with -EINVAL. This mirrors the bounds-check pattern added in commit b2bc7c44ed17 ("fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot") and commit 0ca0485e4b2e ("fs/ntfs3: validate rec->used in journal-replay file record check").

References

NVD — CVE-2026-64432 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-64432
git.kernel.org/stable/c/3aa96956ca... WEB
https://git.kernel.org/stable/c/3aa96956ca2200674e2a8f9c23ec6ecd45e5010f
git.kernel.org/stable/c/57382ec6ac... WEB
https://git.kernel.org/stable/c/57382ec6ac63b63dce2789e835fded28b698ae79
git.kernel.org/stable/c/9460468410... WEB
https://git.kernel.org/stable/c/946046841013ebac8492ef49651c53638d7a9a6a
git.kernel.org/stable/c/964c3fae1d... WEB
https://git.kernel.org/stable/c/964c3fae1dfc49dde5468eace940f199cda234e9
git.kernel.org/stable/c/c6f9e804f7... WEB
https://git.kernel.org/stable/c/c6f9e804f73ef809529865fbc7256dd189ff8c33
git.kernel.org/stable/c/cf28fc1658... WEB
https://git.kernel.org/stable/c/cf28fc1658463d768657cf1c27a83980d4ba7ef2
git.kernel.org/stable/c/f433acc85b... WEB
https://git.kernel.org/stable/c/f433acc85b86f327d03ba8b03a33c105c51053de

Frequently Asked Questions

What is CVE-2026-64432?
CVE-2026-64432 is a security vulnerability in Software classified as a security vulnerability vulnerability under CWE-787: Out-of-bounds Write.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-64432?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-64432?
CVE-2026-64432 has a CVSS v3.1 base score of 7.8 (HIGH) with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
What CWE is associated with CVE-2026-64432?
CVE-2026-64432 is classified under CWE-787: Out-of-bounds Write (The product writes data past the end, or before the beginning, of the intended buffer.).
How can I check Maven dependencies for CVE-2026-64432?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-4xg7-26qr-mccf",
  "modified" : "2026-07-27T06:30:37Z",
  "published" : "2026-07-25T12:31:35Z",
  "aliases" : [ "CVE-2026-64432" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns\n\nIn the analysis pass of $LogFile journal replay, log_replay() copies\nLCNs from each action log record into an existing Dirty Page Table\n(DPT) entry without bounding the destination index. A crafted NTFS\nimage with DPT entry lcns_follow=1 and an action log record with\nlcns_follow=2 produces a kernel slab out-of-bounds write at mount\ntime:\n\n  BUG: KASAN: slab-out-of-bounds in log_replay+0x654c/0xdb60\n  Write of size 8 at addr ffff8880095e1040 by task mount\n\nTwo attacker-controlled fields can drive j+i past the allocated\npage_lcns[] array:\n\n  1. dp->lcns_follow (capacity) can be smaller than lrh->lcns_follow.\n  2. lrh->target_vcn may be smaller than dp->vcn, making the u64\n     subtraction wrap to a huge size_t.\n\nValidate target VCN delta and per-record LCN count against the\nDPT entry capacity, bail via the existing out: cleanup label with\n-EINVAL.\n\nThis mirrors the bounds-check pattern added in commit b2bc7c44ed17\n(\"fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot\")\nand commit 0ca0485e4b2e (\"fs/ntfs3: validate rec->used in\njournal-replay file record check\").",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-64432"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/3aa96956ca2200674e2a8f9c23ec6ecd45e5010f"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/57382ec6ac63b63dce2789e835fded28b698ae79"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/946046841013ebac8492ef49651c53638d7a9a6a"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/964c3fae1dfc49dde5468eace940f199cda234e9"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/c6f9e804f73ef809529865fbc7256dd189ff8c33"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/cf28fc1658463d768657cf1c27a83980d4ba7ef2"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/f433acc85b86f327d03ba8b03a33c105c51053de"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-787" ],
    "severity" : "HIGH",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-07-25T10:17:27Z"
  }
}