CVE-2026-74485: Software Security Vulnerability Vulnerability

HIGH
Advisory Identifier: GHSA-9rj7-pvjp-5h34
Share
CVSS 7.1
Published
Advisory Summary

CVE-2026-74485 is a HIGH (CVSS 7.1) security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-74485 at a Glance

CVE Identifier CVE-2026-74485
GHSA Identifier GHSA-9rj7-pvjp-5h34
Severity HIGH
CVSS v3.1 Base Score 7.1
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 7.1

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H).

Attack Vector Local (AV:L)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity None (I:N)
Availability High (A:H)

How to Fix CVE-2026-74485

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-74485, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: reject a flag character as the field delimiter The registration string starts with a user chosen delimiter that separates the individual fields. So that the field parsers terminate even on a truncated string create_entry() pads the buffer with that same delimiter: memset(buf + count, del, 8); Most fields are scanned for the delimiter with strchr()/scanarg() and happily stop on the padding. The flags field is different: instead of scanning for the delimiter check_special_flags() consumes the flag characters 'P', 'O', 'C' and 'F' and stops at the first byte that is none of them, relying on the trailing delimiter to end the scan. If the delimiter is itself a flag character the padding no longer acts as a terminator. The scan swallows all eight padding bytes and keeps reading past the end of the allocation until it hits a byte that is not a flag character. For example registering PaPEPPxPPiP with 'P' as the delimiter (name "a", type extension, magic "x", interpreter "i", empty flags) leaves the flag scan running off the end of the buffer. The registration is rejected in the end because the parser does not stop exactly at buf + count, but only after the out of bounds read has already happened. With an unlucky allocation layout the scan can walk into an unmapped page; under KASAN it is reported as a slab out of bounds read. binfmt_misc mounts are available to unprivileged users in a user namespace so the read is reachable without privileges. Reject a delimiter that is one of the flag characters up front. Such a registration was always rejected anyway, only after the out of bounds read, so no valid registration string changes meaning.

References

NVD — CVE-2026-74485 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-74485
git.kernel.org/stable/c/1819f82dee... WEB
https://git.kernel.org/stable/c/1819f82dee766c58295ecaacdac02cdf6837d7a4
git.kernel.org/stable/c/1853e95c9b... WEB
https://git.kernel.org/stable/c/1853e95c9bfe69ef1dd862b3f551e68f4a1b76cc
git.kernel.org/stable/c/840bb9c49c... WEB
https://git.kernel.org/stable/c/840bb9c49c3e75fb32b593d67ab32f6b77122262
git.kernel.org/stable/c/8e85d50ba1... WEB
https://git.kernel.org/stable/c/8e85d50ba1117fd446bf9a250bd8a97d48384bdc
git.kernel.org/stable/c/96bd5d4fea... WEB
https://git.kernel.org/stable/c/96bd5d4fea2970b9b08265293ca7a10b9b27c0fd
git.kernel.org/stable/c/9970e094e5... WEB
https://git.kernel.org/stable/c/9970e094e5d60f0d66914bf9a97d1ef19107ebf5
git.kernel.org/stable/c/9a2d87db38... WEB
https://git.kernel.org/stable/c/9a2d87db3898b5993b64fd258d0334e0eba9ee0d
git.kernel.org/stable/c/b29e3c1f37... WEB
https://git.kernel.org/stable/c/b29e3c1f375c1296362d219ff38bceddf2d2a88a

Frequently Asked Questions

What is CVE-2026-74485?
CVE-2026-74485 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-74485?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-74485?
CVE-2026-74485 has a CVSS v3.1 base score of 7.1 (HIGH) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H.
What CWE is associated with CVE-2026-74485?
CVE-2026-74485 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-74485?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-9rj7-pvjp-5h34",
  "modified" : "2026-08-19T18:32:28Z",
  "published" : "2026-08-15T15:30:34Z",
  "aliases" : [ "CVE-2026-74485" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nbinfmt_misc: reject a flag character as the field delimiter\n\nThe registration string starts with a user chosen delimiter that\nseparates the individual fields. So that the field parsers terminate\neven on a truncated string create_entry() pads the buffer with that\nsame delimiter:\n\n\tmemset(buf + count, del, 8);\n\nMost fields are scanned for the delimiter with strchr()/scanarg() and\nhappily stop on the padding. The flags field is different: instead of\nscanning for the delimiter check_special_flags() consumes the flag\ncharacters 'P', 'O', 'C' and 'F' and stops at the first byte that is\nnone of them, relying on the trailing delimiter to end the scan.\n\nIf the delimiter is itself a flag character the padding no longer acts\nas a terminator. The scan swallows all eight padding bytes and keeps\nreading past the end of the allocation until it hits a byte that is\nnot a flag character. For example registering\n\n\tPaPEPPxPPiP\n\nwith 'P' as the delimiter (name \"a\", type extension, magic \"x\",\ninterpreter \"i\", empty flags) leaves the flag scan running off the end\nof the buffer. The registration is rejected in the end because the\nparser does not stop exactly at buf + count, but only after the out of\nbounds read has already happened. With an unlucky allocation layout the\nscan can walk into an unmapped page; under KASAN it is reported as a\nslab out of bounds read. binfmt_misc mounts are available to\nunprivileged users in a user namespace so the read is reachable without\nprivileges.\n\nReject a delimiter that is one of the flag characters up front. Such a\nregistration was always rejected anyway, only after the out of bounds\nread, so no valid registration string changes meaning.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-74485"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/1819f82dee766c58295ecaacdac02cdf6837d7a4"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/1853e95c9bfe69ef1dd862b3f551e68f4a1b76cc"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/840bb9c49c3e75fb32b593d67ab32f6b77122262"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/8e85d50ba1117fd446bf9a250bd8a97d48384bdc"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/96bd5d4fea2970b9b08265293ca7a10b9b27c0fd"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/9970e094e5d60f0d66914bf9a97d1ef19107ebf5"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/9a2d87db3898b5993b64fd258d0334e0eba9ee0d"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/b29e3c1f375c1296362d219ff38bceddf2d2a88a"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "HIGH",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-08-15T13:17:53Z"
  }
}