CVE-2026-64330: Software Security Vulnerability Vulnerability

HIGH
Advisory Identifier: GHSA-5x5w-f8x6-m8wf
Share
CVSS 7.8
CWE-129
Published
Advisory Summary

CVE-2026-64330 is a HIGH (CVSS 7.8) security vulnerability vulnerability (CWE-129: Improper Validation of Array Index) affecting Software libraries in the Maven ecosystem. The weakness occurs when the product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.. Remediation is available in the latest vendor maintenance releases.

CVE-2026-64330 at a Glance

CVE Identifier CVE-2026-64330
GHSA Identifier GHSA-5x5w-f8x6-m8wf
Severity HIGH
CVSS v3.1 Base Score 7.8
CWE Classification CWE-129: Improper Validation of Array Index
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 7.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Attack Vector Local (AV:L)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability High (A:H)

How to Fix CVE-2026-64330

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-64330, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-129: Improper Validation of Array Index, where the product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: Validate SVID index in svdm_consume_modes() In svdm_consume_modes(), the SVID value is read from pmdata->svids using pmdata->svid_index as an array index without bounds validation: paltmode->svid = pmdata->svids[pmdata->svid_index]; If pmdata->svid_index is driven beyond SVID_DISCOVERY_MAX (16), it results in an out-of-bounds read of the pmdata->svids array. Because pd_mode_data is embedded inside struct tcpm_port, indexing past svids reads into adjacent fields. In particular: - At index 16, it reads the altmodes count. - At index 18 and beyond, it reads into altmode_desc[], which contains partner-supplied SVDM Discovery Modes VDOs. By injecting a chosen SVID into altmode_desc[0].vdo and driving svid_index to 20, the partner can force paltmode->svid to be loaded with an arbitrary, partner- chosen SVID, which is then registered via typec_partner_register_altmode(). Fix this by validating that pmdata->svid_index is non-negative and strictly less than pmdata->nsvids before accessing the pmdata->svids array inside svdm_consume_modes().

References

NVD — CVE-2026-64330 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-64330
git.kernel.org/stable/c/012406f89a... WEB
https://git.kernel.org/stable/c/012406f89abc52d1d5f07aa5653b519ebf6d2407
git.kernel.org/stable/c/313ca06e7e... WEB
https://git.kernel.org/stable/c/313ca06e7e224ca1dfadd5722fe71fb8bc276b8b
git.kernel.org/stable/c/3e1b1ac47e... WEB
https://git.kernel.org/stable/c/3e1b1ac47e8163627f159f30d80d51b914620dd4
git.kernel.org/stable/c/7b681dd5fb... WEB
https://git.kernel.org/stable/c/7b681dd5fbf60b24a13c14661e5b7735759fb491
git.kernel.org/stable/c/89ff289cbf... WEB
https://git.kernel.org/stable/c/89ff289cbf5d3b659a2babc5ccaae4eaf7e7cf53
git.kernel.org/stable/c/c6d2af3b21... WEB
https://git.kernel.org/stable/c/c6d2af3b217a525741c472f0ab45d7d274b8468f
git.kernel.org/stable/c/d638ec188e... WEB
https://git.kernel.org/stable/c/d638ec188e95fe60f4b01106ffd41958f8fb3c2c
git.kernel.org/stable/c/f8163c414d... WEB
https://git.kernel.org/stable/c/f8163c414de8640f2ca82ce4dc93409d4cdc2fad

Frequently Asked Questions

What is CVE-2026-64330?
CVE-2026-64330 is a security vulnerability in Software classified as a security vulnerability vulnerability under CWE-129: Improper Validation of Array Index.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-64330?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-64330?
CVE-2026-64330 has a CVSS v3.1 base score of 7.8 (HIGH) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
What CWE is associated with CVE-2026-64330?
CVE-2026-64330 is classified under CWE-129: Improper Validation of Array Index (The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.).
How can I check Maven dependencies for CVE-2026-64330?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-5x5w-f8x6-m8wf",
  "modified" : "2026-09-04T15:35:50Z",
  "published" : "2026-07-25T12:31:31Z",
  "aliases" : [ "CVE-2026-64330" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: tcpm: Validate SVID index in svdm_consume_modes()\n\nIn svdm_consume_modes(), the SVID value is read from pmdata->svids using\npmdata->svid_index as an array index without bounds validation:\n\n    paltmode->svid = pmdata->svids[pmdata->svid_index];\n\nIf pmdata->svid_index is driven beyond SVID_DISCOVERY_MAX (16), it results\nin an out-of-bounds read of the pmdata->svids array. Because pd_mode_data\nis embedded inside struct tcpm_port, indexing past svids reads into\nadjacent fields. In particular:\n- At index 16, it reads the altmodes count.\n- At index 18 and beyond, it reads into altmode_desc[], which contains\n  partner-supplied SVDM Discovery Modes VDOs.\n\nBy injecting a chosen SVID into altmode_desc[0].vdo and driving svid_index\nto 20, the partner can force paltmode->svid to be loaded with an arbitrary,\npartner- chosen SVID, which is then registered via\ntypec_partner_register_altmode().\n\nFix this by validating that pmdata->svid_index is non-negative and strictly\nless than pmdata->nsvids before accessing the pmdata->svids array inside\nsvdm_consume_modes().",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-64330"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/012406f89abc52d1d5f07aa5653b519ebf6d2407"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/313ca06e7e224ca1dfadd5722fe71fb8bc276b8b"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/3e1b1ac47e8163627f159f30d80d51b914620dd4"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/7b681dd5fbf60b24a13c14661e5b7735759fb491"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/89ff289cbf5d3b659a2babc5ccaae4eaf7e7cf53"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/c6d2af3b217a525741c472f0ab45d7d274b8468f"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/d638ec188e95fe60f4b01106ffd41958f8fb3c2c"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/f8163c414de8640f2ca82ce4dc93409d4cdc2fad"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-129" ],
    "severity" : "HIGH",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-07-25T10:17:14Z"
  }
}