CVE-2026-46022: Software Security Vulnerability Vulnerability

HIGH
Advisory Identifier: GHSA-cpgx-54rr-4jm6
Share
CVSS 7.1
CWE-125
Published
Advisory Summary

CVE-2026-46022 is a HIGH (CVSS 7.1) security vulnerability vulnerability (CWE-125: Out-of-bounds Read) affecting Software libraries in the Maven ecosystem. The weakness occurs when the product reads data past the end, or before the beginning, of the intended buffer.. Remediation is available in the latest vendor maintenance releases.

CVE-2026-46022 at a Glance

CVE Identifier CVE-2026-46022
GHSA Identifier GHSA-cpgx-54rr-4jm6
Severity HIGH
CVSS v3.1 Base Score 7.1
CWE Classification CWE-125: Out-of-bounds Read
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 7.1

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H).

Attack Vector Local (AV:L)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity None (I:N)
Availability High (A:H)

How to Fix CVE-2026-46022

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-46022, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-125: Out-of-bounds Read, where the product reads data past the end, or before the beginning, of the intended buffer. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() ibmasm_handle_mouse_interrupt() performs an out-of-bounds MMIO read when the queue reader or writer index from hardware exceeds REMOTE_QUEUE_SIZE (60). A compromised service processor can trigger this by writing an out-of-range value to the reader or writer MMIO register before asserting an interrupt. Since writer is re-read from hardware on every loop iteration, it can also be set to an out-of-range value after the loop has already started. The root cause is that get_queue_reader() and get_queue_writer() return raw readl() values that are passed directly into get_queue_entry(), which computes: queue_begin + reader * sizeof(struct remote_input) with no bounds check. This unchecked MMIO address is then passed to memcpy_fromio(), reading 8 bytes from unintended device registers. For sufficiently large values the address falls outside the PCI BAR mapping entirely, triggering a machine check exception. Fix by checking both indices against REMOTE_QUEUE_SIZE at the top of the loop body, before any call to get_queue_entry(). On an out-of-range value, reset the reader register to 0 via set_queue_reader() before breaking, so that normal queue operation can resume if the corrupted hardware state is transient.

References

NVD — CVE-2026-46022 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-46022
cert-portal.siemens.com/productcert/html/ss... WEB
https://cert-portal.siemens.com/productcert/html/ssa-784472.html
git.kernel.org/stable/c/07c4f18b30... WEB
https://git.kernel.org/stable/c/07c4f18b303106e6b24492c12b95d48a4b985841
git.kernel.org/stable/c/1ca75f6b74... WEB
https://git.kernel.org/stable/c/1ca75f6b74ec7f685464e5745ecfcf3a76d284e9
git.kernel.org/stable/c/22a16d3eaf... WEB
https://git.kernel.org/stable/c/22a16d3eafee92a165c756081587c95850127107
git.kernel.org/stable/c/4b6e6ead55... WEB
https://git.kernel.org/stable/c/4b6e6ead556734bdc14024c5f837132b1e7a4b84
git.kernel.org/stable/c/6f6ecc9153... WEB
https://git.kernel.org/stable/c/6f6ecc9153df176e956d0664b56f93080b0a45f0
git.kernel.org/stable/c/bac8643486... WEB
https://git.kernel.org/stable/c/bac8643486f854dd53af9b23aea7dbbd9b7c1865
git.kernel.org/stable/c/f7e5b4eefd... WEB
https://git.kernel.org/stable/c/f7e5b4eefd7be3e09f8bd5fee63ed478fd7446ab
git.kernel.org/stable/c/fc7e9a74e3... WEB
https://git.kernel.org/stable/c/fc7e9a74e32299d7e93e178ca482a0b59ef1595b

Frequently Asked Questions

What is CVE-2026-46022?
CVE-2026-46022 is a security vulnerability in Software classified as a security vulnerability vulnerability under CWE-125: Out-of-bounds Read.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-46022?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-46022?
CVE-2026-46022 has a CVSS v3.1 base score of 7.1 (HIGH) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H.
What CWE is associated with CVE-2026-46022?
CVE-2026-46022 is classified under CWE-125: Out-of-bounds Read (The product reads data past the end, or before the beginning, of the intended buffer.).
How can I check Maven dependencies for CVE-2026-46022?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-cpgx-54rr-4jm6",
  "modified" : "2026-10-15T03:35:56Z",
  "published" : "2026-05-27T15:33:21Z",
  "aliases" : [ "CVE-2026-46022" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt()\n\nibmasm_handle_mouse_interrupt() performs an out-of-bounds MMIO read\nwhen the queue reader or writer index from hardware exceeds\nREMOTE_QUEUE_SIZE (60).\n\nA compromised service processor can trigger this by writing an\nout-of-range value to the reader or writer MMIO register before\nasserting an interrupt. Since writer is re-read from hardware on\nevery loop iteration, it can also be set to an out-of-range value\nafter the loop has already started.\n\nThe root cause is that get_queue_reader() and get_queue_writer() return\nraw readl() values that are passed directly into get_queue_entry(),\nwhich computes:\n\n  queue_begin + reader * sizeof(struct remote_input)\n\nwith no bounds check. This unchecked MMIO address is then passed to\nmemcpy_fromio(), reading 8 bytes from unintended device registers.\nFor sufficiently large values the address falls outside the PCI BAR\nmapping entirely, triggering a machine check exception.\n\nFix by checking both indices against REMOTE_QUEUE_SIZE at the top of\nthe loop body, before any call to get_queue_entry(). On an out-of-range\nvalue, reset the reader register to 0 via set_queue_reader() before\nbreaking, so that normal queue operation can resume if the corrupted\nhardware state is transient.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-46022"
  }, {
    "type" : "WEB",
    "url" : "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/07c4f18b303106e6b24492c12b95d48a4b985841"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/1ca75f6b74ec7f685464e5745ecfcf3a76d284e9"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/22a16d3eafee92a165c756081587c95850127107"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/4b6e6ead556734bdc14024c5f837132b1e7a4b84"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/6f6ecc9153df176e956d0664b56f93080b0a45f0"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/bac8643486f854dd53af9b23aea7dbbd9b7c1865"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/f7e5b4eefd7be3e09f8bd5fee63ed478fd7446ab"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/fc7e9a74e32299d7e93e178ca482a0b59ef1595b"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-125" ],
    "severity" : "HIGH",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-05-27T14:17:20Z"
  }
}