CVE-2026-41988CWE-670

uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6

Low · published April 23, 2026

CVSS v3.1
3.2
EPSS
0%
Percentile
2.4
In the wild
Unconfirmed
What it is

uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. In particular, UUID version 4, which is very commonly used, is unaffected by this issue.

The record
Technical detail
CVSS v3.1
3.2 · LOW
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00130 · 2.4th percentile
Weakness
CWE-670 · Always-Incorrect Control Flow Implementation
Published
2026-04-23T04:00Z
EPSS history
Timeline
  • 23 APR 04:00Z
    uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6
    cvelistv5