CVE-2026-41907CWE-787CWE-823

uuid: Missing buffer bounds check in `v3`/`v5`/`v6` when `buf` is provided

High · published April 24, 2026

CVSS v4.0
8.1
EPSS
0%
Percentile
30.5
In the wild
Unconfirmed
What it is

uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.

The record
Technical detail
CVSS v4.0
8.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
EPSS
0.00378 · 30.5th percentile
Weaknesses
CWE-787 · Out-of-bounds Write; CWE-823 · Use of Out-of-range Pointer Offset
Published
2026-04-24T18:09Z
EPSS history
Timeline
  • 24 APR 18:09Z
    uuid: Missing buffer bounds check in `v3`/`v5`/`v6` when `buf` is provided
    cvelistv5