CVE-2026-68589

MediumCVSS 6.7/10Last modified Nov 12, 2026

Description

In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY01320076; Issue ID: MSV-6889.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Nov 2, 2026
Last modified: Nov 12, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-68598.8A flaw was found in InstructLab. The `linux_train.py` script hardcodes `trust_remote_code=True` when loading models from HuggingFace. This a CVE-2026-685905.3In ip_stack, there is a possible out of bounds read due to improper input validation. This could lead to remote denial of service, if a UE h CVE-2026-685916.7In Modem, there is a possible escalation of privilege due to a permissions bypass. This could lead to local escalation of privilege (EoP) if CVE-2026-68605.3A TCP client can perform a TLS handshake and present the server name extension with a server name that is accepted by a server wildcard name CVE-2026-68617.1A flaw was found in GNU Emacs. This vulnerability, a memory corruption issue, occurs when Emacs processes specially crafted SVG (Scalable Ve CVE-2026-68625.5A flaw was found in libefiboot, a component of efivar. The device path node parser in libefiboot fails to validate that each node's Length f CVE-2026-68636.8Velociraptor versions prior to 0.76.4 contain a cross organization authorization bypass in the HTTP API. A user with only the reader role in CVE-2026-68646.1The CBX 5 Star Rating & Review plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions CVE-2026-68657.1CWE-22: Improper Limitation of a Pathname to a Restricted Directory (“Path Traversal”) vulnerability that could cause unauthorized access to CVE-2026-68667.5CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclosure of sensitive in CVE-2026-68675.5SMB2 protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service CVE-2026-68687.5HTTP protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service