CVE-2026-64456: Software Security Vulnerability Vulnerability

HIGH

Advisory Identifier: GHSA-7vrc-rff8-p548

CVSS 7.7

Published 2026-07-25

Advisory Summary

CVE-2026-64456 is a HIGH (CVSS 7.7) security vulnerability vulnerability (CWE-125: Out-of-bounds Read) affecting Software libraries in the Maven ecosystem. The weakness occurs when the product reads data past the end, or before the beginning, of the intended buffer.. Remediation is available in the latest vendor maintenance releases.

CVE-2026-64456 at a Glance

CVE Identifier CVE-2026-64456

GHSA Identifier GHSA-7vrc-rff8-p548

Severity HIGH

CVSS v3.1 Base Score 7.7

CWE Classification CWE-125: Out-of-bounds Read

Affected Product Software

Package Ecosystem Maven

Published Date 2026-07-25

Last Updated 2026-07-27

Security Impact

CVSS: 7.7

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).

Attack Vector Local (AV:L)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality High (C:H)

Integrity None (I:N)

Availability High (A:H)

How to Fix CVE-2026-64456

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-64456, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-125: Out-of-bounds Read, where the product reads data past the end, or before the beginning, of the intended buffer. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: hwrng: virtio: clamp device-reported used.len at copy_data() random_recv_done() stores the device-reported used.len directly into vi->data_avail. copy_data() then indexes vi->data[] using vi->data_idx (advanced by previous copy_data() calls) and issues a memcpy() without re-validating either value against the posted buffer size sizeof(vi->data) (SMP_CACHE_BYTES bytes, typically 32 or 64). A malicious or buggy virtio-rng backend can set used.len beyond sizeof(vi->data), steering the memcpy() past the end of the inline array into adjacent kmalloc-1k slab bytes. hwrng_fillfn() mixes those bytes into the guest RNG, and guest root can also observe them directly via /dev/hwrng. Concrete impact is inside the guest: - Memory-safety / hardening: any virtio-rng backend that over-reports used.len causes the driver to read past vi->data into unrelated slab contents. hwrng_fillfn() is a kernel thread that runs as soon as the device is probed; no guest userspace interaction is required to first-trigger the OOB. - Cross-boundary leak (confidential-compute threat model): a malicious hypervisor cooperating with a malicious or compromised guest root userspace can use /dev/hwrng as a leak channel for guest-kernel heap data. The host sets a large used.len, guest root reads /dev/hwrng, and the returned bytes contain guest kernel slab contents that were adjacent to vi->data. In practice, confidential-compute guests (SEV-SNP, TDX) usually disable virtio-rng entirely, so this path is narrow, but the fix is still worth carrying because the underlying memory-safety bug contaminates the guest RNG on any host. KASAN confirms the OOB on a 7.1-rc4 guest whose virtio-rng backend has been patched to report used.len = 0x10000: BUG: KASAN: slab-out-of-bounds in virtio_read+0x394/0x5d0 Read of size 64 at addr ffff88800ae0ba20 by task hwrng/52 Call Trace: __asan_memcpy+0x23/0x60 virtio_read+0x394/0x5d0 hwrng_fillfn+0xb2/0x470 kthread+0x2cc/0x3a0 Allocated by task 1: probe_common+0xa5/0x660 virtio_dev_probe+0x549/0xbc0 The buggy address belongs to the object at ffff88800ae0b800 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 0 bytes to the right of allocated 544-byte region [ffff88800ae0b800, ffff88800ae0ba20) Same class of bug as commit c04db81cd028 ("net/9p: Fix buffer overflow in USB transport layer"), which hardened usb9pfs_rx_complete() against unchecked device-reported length in the USB 9p transport. With the clamp at point of use and array_index_nospec() in place, the same harness boots cleanly: copy_data() returns zero for the bogus report, the device-supplied bytes after data_idx are discarded, and the driver issues a fresh request.

References

NVD — CVE-2026-64456 NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-64456

git.kernel.org/stable/c/285e17c44e... WEB

https://git.kernel.org/stable/c/285e17c44e3873a73460f294acbd64018ff64385

git.kernel.org/stable/c/2e788948ff... WEB

https://git.kernel.org/stable/c/2e788948ff2a13358a303af112497a63201c5739

git.kernel.org/stable/c/3aa3e89cf8... WEB

https://git.kernel.org/stable/c/3aa3e89cf80721c8d382b4c1a2b70a0449dad4a5

git.kernel.org/stable/c/63335e7b63... WEB

https://git.kernel.org/stable/c/63335e7b638ae70028ae285bb95153874a8bc852

git.kernel.org/stable/c/81dd21b5f0... WEB

https://git.kernel.org/stable/c/81dd21b5f0c299cc7b5bf84f04a61938559d20e6

git.kernel.org/stable/c/92d5736a62... WEB

https://git.kernel.org/stable/c/92d5736a62040ec1cfff23ea57e6599301690ad5

git.kernel.org/stable/c/e3046eeada... WEB

https://git.kernel.org/stable/c/e3046eeada299f917a8ad883af4434bfb86556b1

git.kernel.org/stable/c/fde19b0d4e... WEB

https://git.kernel.org/stable/c/fde19b0d4eeabae042519313c843fe6f27d41e9d

Frequently Asked Questions

What is CVE-2026-64456?

CVE-2026-64456 is a security vulnerability in Software classified as a security vulnerability vulnerability under CWE-125: Out-of-bounds Read.

Which Software versions are affected?

Affected versions include releases prior to current release patches.

What version fixes CVE-2026-64456?

Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.

What is the CVSS score of CVE-2026-64456?

CVE-2026-64456 has a CVSS v3.1 base score of 7.7 (HIGH) with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H.

What CWE is associated with CVE-2026-64456?

CVE-2026-64456 is classified under CWE-125: Out-of-bounds Read (The product reads data past the end, or before the beginning, of the intended buffer.).

How can I check Maven dependencies for CVE-2026-64456?

Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-7vrc-rff8-p548",
  "modified" : "2026-07-27T06:30:39Z",
  "published" : "2026-07-25T12:31:36Z",
  "aliases" : [ "CVE-2026-64456" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nhwrng: virtio: clamp device-reported used.len at copy_data()\n\nrandom_recv_done() stores the device-reported used.len directly into\nvi->data_avail.  copy_data() then indexes vi->data[] using\nvi->data_idx (advanced by previous copy_data() calls) and issues a\nmemcpy() without re-validating either value against the posted\nbuffer size sizeof(vi->data) (SMP_CACHE_BYTES bytes, typically 32\nor 64).\n\nA malicious or buggy virtio-rng backend can set used.len beyond\nsizeof(vi->data), steering the memcpy() past the end of the inline\narray into adjacent kmalloc-1k slab bytes.  hwrng_fillfn() mixes\nthose bytes into the guest RNG, and guest root can also observe\nthem directly via /dev/hwrng.\n\nConcrete impact is inside the guest:\n\n - Memory-safety / hardening: any virtio-rng backend that\n   over-reports used.len causes the driver to read past vi->data\n   into unrelated slab contents.  hwrng_fillfn() is a kernel thread\n   that runs as soon as the device is probed; no guest userspace\n   interaction is required to first-trigger the OOB.\n\n - Cross-boundary leak (confidential-compute threat model): a\n   malicious hypervisor cooperating with a malicious or compromised\n   guest root userspace can use /dev/hwrng as a leak channel for\n   guest-kernel heap data.  The host sets a large used.len, guest\n   root reads /dev/hwrng, and the returned bytes contain guest\n   kernel slab contents that were adjacent to vi->data.  In\n   practice, confidential-compute guests (SEV-SNP, TDX) usually\n   disable virtio-rng entirely, so this path is narrow, but the\n   fix is still worth carrying because the underlying\n   memory-safety bug contaminates the guest RNG on any host.\n\nKASAN confirms the OOB on a 7.1-rc4 guest whose virtio-rng backend\nhas been patched to report used.len = 0x10000:\n\n  BUG: KASAN: slab-out-of-bounds in virtio_read+0x394/0x5d0\n  Read of size 64 at addr ffff88800ae0ba20 by task hwrng/52\n  Call Trace:\n   __asan_memcpy+0x23/0x60\n   virtio_read+0x394/0x5d0\n   hwrng_fillfn+0xb2/0x470\n   kthread+0x2cc/0x3a0\n  Allocated by task 1:\n   probe_common+0xa5/0x660\n   virtio_dev_probe+0x549/0xbc0\n  The buggy address belongs to the object at ffff88800ae0b800\n   which belongs to the cache kmalloc-1k of size 1024\n  The buggy address is located 0 bytes to the right of\n   allocated 544-byte region [ffff88800ae0b800, ffff88800ae0ba20)\n\nSame class of bug as commit c04db81cd028 (\"net/9p: Fix buffer\noverflow in USB transport layer\"), which hardened\nusb9pfs_rx_complete() against unchecked device-reported length in\nthe USB 9p transport.\n\nWith the clamp at point of use and array_index_nospec() in place,\nthe same harness boots cleanly: copy_data() returns zero for the\nbogus report, the device-supplied bytes after data_idx are\ndiscarded, and the driver issues a fresh request.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-64456"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/285e17c44e3873a73460f294acbd64018ff64385"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/2e788948ff2a13358a303af112497a63201c5739"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/3aa3e89cf80721c8d382b4c1a2b70a0449dad4a5"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/63335e7b638ae70028ae285bb95153874a8bc852"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/81dd21b5f0c299cc7b5bf84f04a61938559d20e6"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/92d5736a62040ec1cfff23ea57e6599301690ad5"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/e3046eeada299f917a8ad883af4434bfb86556b1"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/fde19b0d4eeabae042519313c843fe6f27d41e9d"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-125" ],
    "severity" : "HIGH",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-07-25T10:17:30Z"
  }
}

CVSS V3

7.7 HIGH