CVE-2026-11312

LowCVSS 3.3/10Last modified Jul 23, 2026

Description

A vulnerability was found in bytedance InfiniStore up to 0.2.33. The impacted element is the function purge_kv_map in the library /src/infinistore.h of the component KV Map Handler. Performing a manipulation results in inefficient algorithmic complexity. The attack requires a local approach. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-404CWE-407

Affected software

VendorProductVersions
bytedanceInfiniStore0.2.0; 0.2.1; 0.2.2; 0.2.3; 0.2.4; 0.2.5; 0.2.6; 0.2.7; 0.2.8; 0.2.9; 0.2.10; 0.2.11; 0.2.12; 0.2.13; 0.2.14; 0.2.15; 0.2.16; 0.2.17; 0.2.18; 0.2.19

References

Timeline

Published
Jun 5, 2026
Last modified
Jul 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1131208.8Use of uninitialized variable in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside tCVE-2026-1131218.8Use of released resource in ContextMenu in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social enCVE-2026-1131226.5Incorrect authorization in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafteCVE-2026-1131238.8Uninitialized resource in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafCVE-2026-1131248.8Improper input validation in DataTransfer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering toCVE-2026-1131258.8Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crCVE-2026-1131269.6Improper resource exposure in PolicyContainer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy CVE-2026-1131278.8Confused deputy in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy into a privileged pCVE-2026-1131288.8Information leak in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via a crafted CVE-2026-1131296.5Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictionsCVE-2026-1131308.8Incorrect authorization in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass wCVE-2026-1131318.8Incorrect authorization in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer proc
CVE-2026-11312: Low severity, CVSS 3.3 | Vulnix