CVE-2026-86848

HighCVSS 8.8/10Last modified Oct 14, 2026

Description

A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-367

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 14, 2026
Last modified: Oct 14, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-868496.5A flaw was found in DPDK lib/vhost vhost-crypto. Integer overflow in chain length checks, and missing length checks on the RSA path, can ove CVE-2026-86856.5The Infility Global plugin for WordPress is vulnerable to SQL Injection via the 'orderby' and 'order' parameters in all versions up to, and CVE-2026-868506.5The SKU Error Fixer for WooCommerce WordPress plugin through 1.0 does not perform any capability or nonce checks on two of its AJAX actions,CVE-2026-868516.5The Livees Checkout WordPress plugin through 7.0.2 does not perform any capability, nonce or order-key check before acting on request parame CVE-2026-868534.3A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make CVE-2026-868566.5A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues ar CVE-2026-868578.4ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Platform. This security issue, if CVE-2026-868588.7ServiceNow has remediated an improper access control security issue that was identified in the ServiceNow AI Platform. This security issue c CVE-2026-868598.7ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Platform. This security issue, if CVE-2026-86869.1Missing bounds validation in the MQTT v5.0 property parser in coreMQTT before 5.0.1 allows an MQTT broker to cause a denial of service by se CVE-2026-868609.3ServiceNow has remediated a missing authorization vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could CVE-2026-868615.9pgAdmin 4's File Manager save_file endpoint, which backs saving from the Query Tool and ERD, validated the requested path with Filemanager.c