CVE-2026-14316 (GCVE-0-2026-14316)
Vulnerability from cvelistv5
Published
2026-10-01 16:16
Modified
2026-10-01 16:32
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-122 - Heap-based buffer overflow
Summary
The revoked-key error path builds a human-readable failure reason using sprintf() into a heap buffer. The allocated buffer is too small for the final formatted message. When sprintf() writes the full message, it can write past the end of the heap allocation.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Fortra | Core Privileged Access Manager (BoKS) |
Version: 8.1.0.0 < 8.1.0.30 Version: 10.1.0.0 < 10.1.1.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14316",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-01T16:32:47.169777Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T16:32:54.604Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Core Privileged Access Manager (BoKS)",
"vendor": "Fortra",
"versions": [
{
"lessThan": "8.1.0.30",
"status": "affected",
"version": "8.1.0.0",
"versionType": "custom"
},
{
"lessThan": "10.1.1.0",
"status": "affected",
"version": "10.1.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "This is reachable when RevokedKeys is configured and public-key authentication checks a revoked key or encounters an error while checking the revoked-keys file.\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003e\u003cspan\u003eRevokedKeys must be configured, and the attacker must be able to initiate SSH public-key authentication with a key that is revoked or otherwise triggers an error in revoked-key checking.\u003c/span\u003e\u0026nbsp;\u003c/div\u003e"
}
],
"value": "This is reachable when RevokedKeys is configured and public-key authentication checks a revoked key or encounters an error while checking the revoked-keys file.\n\n\nRevokedKeys must be configured, and the attacker must be able to initiate SSH public-key authentication with a key that is revoked or otherwise triggers an error in revoked-key checking."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe revoked-key error path builds a human-readable failure reason using sprintf() into a heap buffer. T\u003cspan\u003ehe allocated buffer is too small for the final formatted message. When sprintf() writes the full message, it can write past the end of the heap allocation.\u0026nbsp;\u003c/span\u003e\u003c/p\u003e"
}
],
"value": "The revoked-key error path builds a human-readable failure reason using sprintf() into a heap buffer. The allocated buffer is too small for the final formatted message. When sprintf() writes the full message, it can write past the end of the heap allocation."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based buffer overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T16:16:36.508Z",
"orgId": "df4dee71-de3a-4139-9588-11b62fe6c0ff",
"shortName": "Fortra"
},
"references": [
{
"url": "https://www.fortra.com/security/advisories/product-security/fi-2026-019"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to a patched version."
}
],
"value": "Upgrade to a patched version."
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Heap buffer overflow in boks_sshd revoked-key error handling",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "df4dee71-de3a-4139-9588-11b62fe6c0ff",
"assignerShortName": "Fortra",
"cveId": "CVE-2026-14316",
"datePublished": "2026-10-01T16:16:36.508Z",
"dateReserved": "2026-07-01T11:40:47.817Z",
"dateUpdated": "2026-10-01T16:32:54.604Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-14316\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-01T16:32:47.169777Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-01T16:32:51.118Z\"}}], \"cna\": {\"title\": \"Heap buffer overflow in boks_sshd revoked-key error handling\", \"source\": {\"discovery\": \"INTERNAL\"}, \"impacts\": [{\"capecId\": \"CAPEC-100\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-100 Overflow Buffers\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Fortra\", \"product\": \"Core Privileged Access Manager (BoKS)\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.1.0.0\", \"lessThan\": \"8.1.0.30\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"10.1.0.0\", \"lessThan\": \"10.1.1.0\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Upgrade to a patched version.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Upgrade to a patched version.\", \"base64\": false}]}], \"references\": [{\"url\": \"https://www.fortra.com/security/advisories/product-security/fi-2026-019\"}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.5\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"The revoked-key error path builds a human-readable failure reason using sprintf() into a heap buffer. The allocated buffer is too small for the final formatted message. When sprintf() writes the full message, it can write past the end of the heap allocation.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eThe revoked-key error path builds a human-readable failure reason using sprintf() into a heap buffer. T\u003cspan\u003ehe allocated buffer is too small for the final formatted message. When sprintf() writes the full message, it can write past the end of the heap allocation.\u0026nbsp;\u003c/span\u003e\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-122\", \"description\": \"CWE-122 Heap-based buffer overflow\"}]}], \"configurations\": [{\"lang\": \"en\", \"value\": \"This is reachable when RevokedKeys is configured and public-key authentication checks a revoked key or encounters an error while checking the revoked-keys file.\\n\\n\\nRevokedKeys must be configured, and the attacker must be able to initiate SSH public-key authentication with a key that is revoked or otherwise triggers an error in revoked-key checking.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"This is reachable when RevokedKeys is configured and public-key authentication checks a revoked key or encounters an error while checking the revoked-keys file.\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003e\u003cspan\u003eRevokedKeys must be configured, and the attacker must be able to initiate SSH public-key authentication with a key that is revoked or otherwise triggers an error in revoked-key checking.\u003c/span\u003e\u0026nbsp;\u003c/div\u003e\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"df4dee71-de3a-4139-9588-11b62fe6c0ff\", \"shortName\": \"Fortra\", \"dateUpdated\": \"2026-10-01T16:16:36.508Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-14316\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-01T16:32:54.604Z\", \"dateReserved\": \"2026-07-01T11:40:47.817Z\", \"assignerOrgId\": \"df4dee71-de3a-4139-9588-11b62fe6c0ff\", \"datePublished\": \"2026-10-01T16:16:36.508Z\", \"assignerShortName\": \"Fortra\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…