CVE-2026-35547CWE-122CWE-130
Heap overflow in libnv
High · published April 30, 2026
What it is
When processing the header of an incoming message, libnv failed to properly validate the message size.
The lack of validation allows a malicious program to write outside the bounds of a heap allocation. This can trigger a crash or system panic, and it may be possible for an unprivileged user to exploit the bug to elevate their privileges.
The record
Technical detail
- CVSS v3.1
- 8.1 · HIGH
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v4.0
- Not supplied
- EPSS
- 0.00404 · 33.5th percentile
- Weaknesses
- CWE-122 · Heap-based Buffer Overflow; CWE-130 · Improper Handling of Length Parameter Inconsistency
- Published
- 2026-04-30T08:08Z
EPSS history
Timeline
30 APR 08:08Z
Heap overflow in libnv
cvelistv5