CVE-2026-64317: Software Security Vulnerability Vulnerability

HIGH
Advisory Identifier: GHSA-qvx5-h96v-vv5j
Share
CVSS 7.1
CWE-125
Published
Advisory Summary

CVE-2026-64317 is a HIGH (CVSS 7.1) security vulnerability vulnerability (CWE-125: Out-of-bounds Read) affecting Software libraries in the Maven ecosystem. The weakness occurs when the product reads data past the end, or before the beginning, of the intended buffer.. Remediation is available in the latest vendor maintenance releases.

CVE-2026-64317 at a Glance

CVE Identifier CVE-2026-64317
GHSA Identifier GHSA-qvx5-h96v-vv5j
Severity HIGH
CVSS v3.1 Base Score 7.1
CWE Classification CWE-125: Out-of-bounds Read
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 7.1

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H).

Attack Vector Local (AV:L)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity None (I:N)
Availability High (A:H)

How to Fix CVE-2026-64317

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-64317, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-125: Out-of-bounds Read, where the product reads data past the end, or before the beginning, of the intended buffer. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: isofs: bound Rock Ridge symlink components to the SL record get_symlink_chunk() and the SL handling in parse_rock_ridge_inode_internal() walk the variable-length components of a Rock Ridge "SL" (symbolic link) record. Each component is a two-byte header (flags, len) followed by len bytes of text, so it occupies slp->len + 2 bytes. Both loops read slp->len and advance to the next component, and get_symlink_chunk() additionally does memcpy(rpnt, slp->text, slp->len), but neither checks that the component lies within the SL record before dereferencing it. A crafted SL record whose component declares a len that runs past the record (rr->len) therefore triggers an out-of-bounds read of up to 255 bytes. When the record sits at the tail of its backing buffer - for example a small kmalloc()ed continuation block reached through a CE record - the read crosses the allocation; get_symlink_chunk() then copies the out-of-bounds bytes into the symlink body returned to user space by readlink(), disclosing adjacent kernel memory. ISO 9660 images are routinely mounted from untrusted removable media - desktop environments auto-mount them (e.g. via udisks2) without CAP_SYS_ADMIN - so the record contents are attacker-controlled. Reject any component that does not fit in the remaining record bytes before using it. In get_symlink_chunk() return NULL, like the existing output-buffer (plimit) checks, so a malformed record makes readlink() fail with -EIO rather than silently returning a truncated target; in parse_rock_ridge_inode_internal() stop the inode-size walk.

References

NVD — CVE-2026-64317 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-64317
cert-portal.siemens.com/productcert/html/ss... WEB
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
cert-portal.siemens.com/productcert/html/ss... WEB
https://cert-portal.siemens.com/productcert/html/ssa-457936.html
git.kernel.org/stable/c/1015e1c4b2... WEB
https://git.kernel.org/stable/c/1015e1c4b2fadd9c09704e24738e46598778c869
git.kernel.org/stable/c/36fe7d25db... WEB
https://git.kernel.org/stable/c/36fe7d25dbc40da0c6b1dd4513a4f69ac6164eee
git.kernel.org/stable/c/5fa1d6a5ec... WEB
https://git.kernel.org/stable/c/5fa1d6a5ec2356d2107dead614437c66fa7138b1
git.kernel.org/stable/c/6bf41db09e... WEB
https://git.kernel.org/stable/c/6bf41db09ef935d76fcc84ccf213b42c18de95ee
git.kernel.org/stable/c/9830725078... WEB
https://git.kernel.org/stable/c/9830725078c8483c6831ec10222ae724806ea36b
git.kernel.org/stable/c/a22cb6bb54... WEB
https://git.kernel.org/stable/c/a22cb6bb54dc167047ea9e70d97dfbc2c15649e3
git.kernel.org/stable/c/b569964264... WEB
https://git.kernel.org/stable/c/b5699642640d6cff357638738c5293985cd5a53d
git.kernel.org/stable/c/b736b12108... WEB
https://git.kernel.org/stable/c/b736b12108fd116c41777628f5a333791604df26

Frequently Asked Questions

What is CVE-2026-64317?
CVE-2026-64317 is a security vulnerability in Software classified as a security vulnerability vulnerability under CWE-125: Out-of-bounds Read.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-64317?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-64317?
CVE-2026-64317 has a CVSS v3.1 base score of 7.1 (HIGH) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H.
What CWE is associated with CVE-2026-64317?
CVE-2026-64317 is classified under CWE-125: Out-of-bounds Read (The product reads data past the end, or before the beginning, of the intended buffer.).
How can I check Maven dependencies for CVE-2026-64317?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-qvx5-h96v-vv5j",
  "modified" : "2026-10-15T03:36:21Z",
  "published" : "2026-07-25T12:31:30Z",
  "aliases" : [ "CVE-2026-64317" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nisofs: bound Rock Ridge symlink components to the SL record\n\nget_symlink_chunk() and the SL handling in\nparse_rock_ridge_inode_internal() walk the variable-length components of\na Rock Ridge \"SL\" (symbolic link) record.  Each component is a two-byte\nheader (flags, len) followed by len bytes of text, so it occupies\nslp->len + 2 bytes.  Both loops read slp->len and advance to the next\ncomponent, and get_symlink_chunk() additionally does\nmemcpy(rpnt, slp->text, slp->len), but neither checks that the component\nlies within the SL record before dereferencing it.\n\nA crafted SL record whose component declares a len that runs past the\nrecord (rr->len) therefore triggers an out-of-bounds read of up to 255\nbytes.  When the record sits at the tail of its backing buffer - for\nexample a small kmalloc()ed continuation block reached through a CE\nrecord - the read crosses the allocation; get_symlink_chunk() then\ncopies the out-of-bounds bytes into the symlink body returned to user\nspace by readlink(), disclosing adjacent kernel memory.\n\nISO 9660 images are routinely mounted from untrusted removable media -\ndesktop environments auto-mount them (e.g. via udisks2) without\nCAP_SYS_ADMIN - so the record contents are attacker-controlled.\n\nReject any component that does not fit in the remaining record bytes\nbefore using it.  In get_symlink_chunk() return NULL, like the existing\noutput-buffer (plimit) checks, so a malformed record makes readlink()\nfail with -EIO rather than silently returning a truncated target; in\nparse_rock_ridge_inode_internal() stop the inode-size walk.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-64317"
  }, {
    "type" : "WEB",
    "url" : "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
  }, {
    "type" : "WEB",
    "url" : "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/1015e1c4b2fadd9c09704e24738e46598778c869"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/36fe7d25dbc40da0c6b1dd4513a4f69ac6164eee"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/5fa1d6a5ec2356d2107dead614437c66fa7138b1"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/6bf41db09ef935d76fcc84ccf213b42c18de95ee"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/9830725078c8483c6831ec10222ae724806ea36b"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/a22cb6bb54dc167047ea9e70d97dfbc2c15649e3"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/b5699642640d6cff357638738c5293985cd5a53d"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/b736b12108fd116c41777628f5a333791604df26"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-125" ],
    "severity" : "HIGH",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-07-25T10:17:13Z"
  }
}