CVE-2026-98499: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-vgmm-5fmr-gjgq
Share
Published
Advisory Summary

CVE-2026-98499 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-98499 at a Glance

CVE Identifier CVE-2026-98499
GHSA Identifier GHSA-vgmm-5fmr-gjgq
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-98499

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-98499, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() The 'wacom_wac_pen_serial_enforce()' function may calculate and pass an invalid offset to hid_field_extract(), resulting in memory reads at incorrect addresses -- possibly beyond the end of the report. If a field in the HID descriptor lists more usages than its Report Count actually reserves space for, the function's inner 'j' will walk past the end of the field: for (i = 0; i < report->maxfield; i++) { for (j = 0; j < report->field[i]->maxusage; j++) { ... value = hid_field_extract(hdev, raw_data + 1, offset + j * size, size); A descriptor listing 12288 usages against Report Count 1 has the loop extract the usage at index 12287 from bit offset 98296 -- about 12 KB past a 2-byte received report. The value is stored in wacom_wac->serial[0] and can reach userspace as an MSC_SERIAL event, making this an information disclosure. Clamp the loop to field->report_count, the number of value slots the report holds. Value slots past the last declared usage are still scanned; they reuse that usage (HID 1.11, 6.2.2.8). Verified on v6.12.105 with a UHID reproducer: a 2-byte report from such a descriptor trips KASAN before the patch and not after it.

References

NVD — CVE-2026-98499 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-98499
git.kernel.org/stable/c/26471d954b... WEB
https://git.kernel.org/stable/c/26471d954bbfbfb9032994f7f485802ee20e0582
git.kernel.org/stable/c/456afe4707... WEB
https://git.kernel.org/stable/c/456afe4707e23cc114ad833197f63b52bb8fd1e7
git.kernel.org/stable/c/4b09b7c84b... WEB
https://git.kernel.org/stable/c/4b09b7c84b8633cd041181616bd15bf5e73c164d
git.kernel.org/stable/c/65e7c4b536... WEB
https://git.kernel.org/stable/c/65e7c4b5366b770c60dfefac3f1d06e33a9e411e
git.kernel.org/stable/c/9aa237cf66... WEB
https://git.kernel.org/stable/c/9aa237cf66495b2426ddde8532e9b08a0ed83aaa
git.kernel.org/stable/c/9aa62f967b... WEB
https://git.kernel.org/stable/c/9aa62f967b6a4bb30aa3b778e02c8a5ca6bcde51
git.kernel.org/stable/c/c3129e6f26... WEB
https://git.kernel.org/stable/c/c3129e6f26e18c0886ede7265f187a7ec289e1d1
git.kernel.org/stable/c/eaa7d29341... WEB
https://git.kernel.org/stable/c/eaa7d29341ef4b91e84ad097562982288a7c376c

Frequently Asked Questions

What is CVE-2026-98499?
CVE-2026-98499 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-98499?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-98499?
CVE-2026-98499 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-98499?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-vgmm-5fmr-gjgq",
  "modified" : "2026-10-18T18:31:51Z",
  "published" : "2026-10-18T18:31:51Z",
  "aliases" : [ "CVE-2026-98499" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()\n\nThe 'wacom_wac_pen_serial_enforce()' function may calculate and pass an\ninvalid offset to hid_field_extract(), resulting in memory reads at\nincorrect addresses -- possibly beyond the end of the report.  If a\nfield in the HID descriptor lists more usages than its Report Count\nactually reserves space for, the function's inner 'j' will walk past\nthe end of the field:\n\n\tfor (i = 0; i < report->maxfield; i++) {\n\t\tfor (j = 0; j < report->field[i]->maxusage; j++) {\n\t\t\t...\n\t\t\tvalue = hid_field_extract(hdev, raw_data + 1,\n\t\t\t\t\t\t  offset + j * size, size);\n\nA descriptor listing 12288 usages against Report Count 1 has the loop\nextract the usage at index 12287 from bit offset 98296 -- about 12 KB\npast a 2-byte received report.  The value is stored in\nwacom_wac->serial[0] and can reach userspace as an MSC_SERIAL event,\nmaking this an information disclosure.\n\nClamp the loop to field->report_count, the number of value slots the\nreport holds.  Value slots past the last declared usage are still\nscanned; they reuse that usage (HID 1.11, 6.2.2.8).\n\nVerified on v6.12.105 with a UHID reproducer: a 2-byte report from\nsuch a descriptor trips KASAN before the patch and not after it.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-98499"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/26471d954bbfbfb9032994f7f485802ee20e0582"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/456afe4707e23cc114ad833197f63b52bb8fd1e7"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/4b09b7c84b8633cd041181616bd15bf5e73c164d"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/65e7c4b5366b770c60dfefac3f1d06e33a9e411e"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/9aa237cf66495b2426ddde8532e9b08a0ed83aaa"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/9aa62f967b6a4bb30aa3b778e02c8a5ca6bcde51"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/c3129e6f26e18c0886ede7265f187a7ec289e1d1"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/eaa7d29341ef4b91e84ad097562982288a7c376c"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-10-18T16:17:00Z"
  }
}