CVE-2026-64277: Software Security Vulnerability Vulnerability

HIGH
Advisory Identifier: GHSA-p39g-x9xh-7wq9
Share
CVSS 7.8
CWE-125 CWE-787
Published
Advisory Summary

CVE-2026-64277 is a HIGH (CVSS 7.8) security vulnerability vulnerability (CWE-125: Out-of-bounds Read) affecting Software libraries in the Maven ecosystem. The weakness occurs when the product reads data past the end, or before the beginning, of the intended buffer.. Remediation is available in the latest vendor maintenance releases.

CVE-2026-64277 at a Glance

CVE Identifier CVE-2026-64277
GHSA Identifier GHSA-p39g-x9xh-7wq9
Severity HIGH
CVSS v3.1 Base Score 7.8
CWE Classification CWE-125: Out-of-bounds Read
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 7.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Attack Vector Local (AV:L)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability High (A:H)

How to Fix CVE-2026-64277

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-64277, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-125: Out-of-bounds Read, where the product reads data past the end, or before the beginning, of the intended buffer. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmi_f3a_initialize() takes the GPIO count from the device query register (f3a->gpio_count = buf & RMI_F3A_GPIO_COUNT, range 0..127). rmi_f3a_map_gpios() then allocates gpio_key_map with min(gpio_count, TRACKSTICK_RANGE_END) == at most 6 entries, but rmi_f3a_attention() iterates the full gpio_count and dereferences gpio_key_map[i], and input->keycodemax is set to the full gpio_count while input->keycode points at the 6-entry allocation. A device that reports gpio_count > 6 therefore causes an out-of-bounds read of gpio_key_map[] on every attention interrupt, and out-of-bounds accesses through the input core's default keymap ioctls: EVIOCGKEYCODE reads past the buffer (leaking adjacent slab memory to user space) and EVIOCSKEYCODE writes a caller-controlled value past it, for any process able to open the evdev node, since input_default_getkeycode() and input_default_setkeycode() only bound the index against keycodemax. Size the keymap for the full gpio_count. The mapping loop is unchanged: it still assigns only the first min(gpio_count, TRACKSTICK_RANGE_END) entries; the remaining slots stay KEY_RESERVED (devm_kcalloc zero-fills) and are skipped when reporting.

References

NVD — CVE-2026-64277 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-64277
git.kernel.org/stable/c/3480e24bc4... WEB
https://git.kernel.org/stable/c/3480e24bc4e178aaa009edb25b6ee12df199e210
git.kernel.org/stable/c/35ed74d32d... WEB
https://git.kernel.org/stable/c/35ed74d32d8260bdfb14a94caf402bf0866bdeec
git.kernel.org/stable/c/502ad7caaa... WEB
https://git.kernel.org/stable/c/502ad7caaa1a445b734c827fa256e5311df67e3d
git.kernel.org/stable/c/57c10915f2... WEB
https://git.kernel.org/stable/c/57c10915f2c16c90e0d46ad00876bf39ece40fc2
git.kernel.org/stable/c/64fb0e1161... WEB
https://git.kernel.org/stable/c/64fb0e1161ccc6b9e48b8df61f07d3c34c01ec42
git.kernel.org/stable/c/850117b637... WEB
https://git.kernel.org/stable/c/850117b637bcb1dcc14be0cf09ac819a8707b42c
git.kernel.org/stable/c/8db211aed8... WEB
https://git.kernel.org/stable/c/8db211aed83733073b0814adaeeab61d4521474e
git.kernel.org/stable/c/ba57f43032... WEB
https://git.kernel.org/stable/c/ba57f430328534501962d60d651e385ffd7af9ca

Frequently Asked Questions

What is CVE-2026-64277?
CVE-2026-64277 is a security vulnerability in Software classified as a security vulnerability vulnerability under CWE-125: Out-of-bounds Read.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-64277?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-64277?
CVE-2026-64277 has a CVSS v3.1 base score of 7.8 (HIGH) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
What CWE is associated with CVE-2026-64277?
CVE-2026-64277 is classified under CWE-125: Out-of-bounds Read (The product reads data past the end, or before the beginning, of the intended buffer.).
How can I check Maven dependencies for CVE-2026-64277?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-p39g-x9xh-7wq9",
  "modified" : "2026-07-27T06:30:31Z",
  "published" : "2026-07-25T12:31:28Z",
  "aliases" : [ "CVE-2026-64277" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - bound the F3A keymap to the GPIO count\n\nrmi_f3a_initialize() takes the GPIO count from the device query register\n(f3a->gpio_count = buf & RMI_F3A_GPIO_COUNT, range 0..127).\nrmi_f3a_map_gpios() then allocates gpio_key_map with\nmin(gpio_count, TRACKSTICK_RANGE_END) == at most 6 entries, but\nrmi_f3a_attention() iterates the full gpio_count and dereferences\ngpio_key_map[i], and input->keycodemax is set to the full gpio_count\nwhile input->keycode points at the 6-entry allocation.\n\nA device that reports gpio_count > 6 therefore causes an out-of-bounds\nread of gpio_key_map[] on every attention interrupt, and out-of-bounds\naccesses through the input core's default keymap ioctls: EVIOCGKEYCODE\nreads past the buffer (leaking adjacent slab memory to user space) and\nEVIOCSKEYCODE writes a caller-controlled value past it, for any process\nable to open the evdev node, since input_default_getkeycode() and\ninput_default_setkeycode() only bound the index against keycodemax.\n\nSize the keymap for the full gpio_count. The mapping loop is unchanged:\nit still assigns only the first min(gpio_count, TRACKSTICK_RANGE_END)\nentries; the remaining slots stay KEY_RESERVED (devm_kcalloc zero-fills)\nand are skipped when reporting.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-64277"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/3480e24bc4e178aaa009edb25b6ee12df199e210"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/35ed74d32d8260bdfb14a94caf402bf0866bdeec"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/502ad7caaa1a445b734c827fa256e5311df67e3d"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/57c10915f2c16c90e0d46ad00876bf39ece40fc2"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/64fb0e1161ccc6b9e48b8df61f07d3c34c01ec42"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/850117b637bcb1dcc14be0cf09ac819a8707b42c"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/8db211aed83733073b0814adaeeab61d4521474e"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/ba57f430328534501962d60d651e385ffd7af9ca"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-125", "CWE-787" ],
    "severity" : "HIGH",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-07-25T10:17:08Z"
  }
}