CVE-2026-26011

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-26011", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-09T21:36:29.553Z", "datePublished": "2026-02-12T20:42:50.758Z", "dateUpdated": "2026-02-13T17:14:40.661Z"}, "containers": {"cna": {"title": "Critical Heap Out-of-bounds Access in `pf_cluster_stats()` via Malicious /initialpose Covariance -- Potential Remote Code Execution", "problemTypes": [{"descriptions": [{"cweId": "CWE-787", "lang": "en", "description": "CWE-787: Out-of-bounds Write", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-122", "lang": "en", "description": "CWE-122: Heap-based Buffer Overflow", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 9.3, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/ros-navigation/navigation2/security/advisories/GHSA-mgj5-g2p6-gc5x", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ros-navigation/navigation2/security/advisories/GHSA-mgj5-g2p6-gc5x"}, {"name": "https://github.com/ros-navigation/navigation2/commit/d09ea82477ce9234678a6febf6890235e0a7ce12", "tags": ["x_refsource_MISC"], "url": "https://github.com/ros-navigation/navigation2/commit/d09ea82477ce9234678a6febf6890235e0a7ce12"}, {"name": "https://github.com/ros-navigation/navigation2/releases/tag/1.3.11", "tags": ["x_refsource_MISC"], "url": "https://github.com/ros-navigation/navigation2/releases/tag/1.3.11"}], "affected": [{"vendor": "ros-navigation", "product": "navigation2", "versions": [{"version": "<= 1.3.11", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-12T20:42:50.758Z"}, "descriptions": [{"lang": "en", "value": "navigation2 is a ROS 2 Navigation Framework and System. In 1.3.11 and earlier, a critical heap out-of-bounds write vulnerability exists in Nav2 AMCL's particle filter clustering logic. By publishing a single crafted geometry_msgs/PoseWithCovarianceStamped message with extreme covariance values to the /initialpose topic, an unauthenticated attacker on the same ROS 2 DDS domain can trigger a negative index write (set->clusters[-1]) into heap memory preceding the allocated buffer. In Release builds, the sole boundary check (assert) is compiled out, leaving zero runtime protection. This primitive allows controlled corruption of the heap chunk metadata(at least the size of the heap chunk where the set->clusters is in is controllable by the attacker), potentially leading to further exploitation. At minimum, it provides a reliable single-packet denial of service that kills localization and halts all navigation."}], "source": {"advisory": "GHSA-mgj5-g2p6-gc5x", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/ros-navigation/navigation2/security/advisories/GHSA-mgj5-g2p6-gc5x", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-13T17:14:36.872087Z", "id": "CVE-2026-26011", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-13T17:14:40.661Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-26011", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-13T17:14:36.872087Z"}}}], "references": [{"url": "https://github.com/ros-navigation/navigation2/security/advisories/GHSA-mgj5-g2p6-gc5x", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-13T17:14:18.790Z"}}], "cna": {"title": "Critical Heap Out-of-bounds Access in `pf_cluster_stats()` via Malicious /initialpose Covariance -- Potential Remote Code Execution", "source": {"advisory": "GHSA-mgj5-g2p6-gc5x", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "ros-navigation", "product": "navigation2", "versions": [{"status": "affected", "version": "<= 1.3.11"}]}], "references": [{"url": "https://github.com/ros-navigation/navigation2/security/advisories/GHSA-mgj5-g2p6-gc5x", "name": "https://github.com/ros-navigation/navigation2/security/advisories/GHSA-mgj5-g2p6-gc5x", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/ros-navigation/navigation2/commit/d09ea82477ce9234678a6febf6890235e0a7ce12", "name": "https://github.com/ros-navigation/navigation2/commit/d09ea82477ce9234678a6febf6890235e0a7ce12", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ros-navigation/navigation2/releases/tag/1.3.11", "name": "https://github.com/ros-navigation/navigation2/releases/tag/1.3.11", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "navigation2 is a ROS 2 Navigation Framework and System. In 1.3.11 and earlier, a critical heap out-of-bounds write vulnerability exists in Nav2 AMCL's particle filter clustering logic. By publishing a single crafted geometry_msgs/PoseWithCovarianceStamped message with extreme covariance values to the /initialpose topic, an unauthenticated attacker on the same ROS 2 DDS domain can trigger a negative index write (set->clusters[-1]) into heap memory preceding the allocated buffer. In Release builds, the sole boundary check (assert) is compiled out, leaving zero runtime protection. This primitive allows controlled corruption of the heap chunk metadata(at least the size of the heap chunk where the set->clusters is in is controllable by the attacker), potentially leading to further exploitation. At minimum, it provides a reliable single-packet denial of service that kills localization and halts all navigation."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787: Out-of-bounds Write"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122: Heap-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-12T20:42:50.758Z"}}}, "cveMetadata": {"cveId": "CVE-2026-26011", "state": "PUBLISHED", "dateUpdated": "2026-02-13T17:14:40.661Z", "dateReserved": "2026-02-09T21:36:29.553Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-12T20:42:50.758Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "navigation2", "vendor": "ros-navigation", "versions": [{"status": "affected", "version": "<= 1.3.11"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:opennav:nav2:*:*:*:*:*:*:*:*", "matchCriteriaId": "2D42D969-E358-4720-94FB-BE2112F7F424", "versionEndIncluding": "1.3.11", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "navigation2 is a ROS 2 Navigation Framework and System. In 1.3.11 and earlier, a critical heap out-of-bounds write vulnerability exists in Nav2 AMCL's particle filter clustering logic. By publishing a single crafted geometry_msgs/PoseWithCovarianceStamped message with extreme covariance values to the /initialpose topic, an unauthenticated attacker on the same ROS 2 DDS domain can trigger a negative index write (set->clusters[-1]) into heap memory preceding the allocated buffer. In Release builds, the sole boundary check (assert) is compiled out, leaving zero runtime protection. This primitive allows controlled corruption of the heap chunk metadata(at least the size of the heap chunk where the set->clusters is in is controllable by the attacker), potentially leading to further exploitation. At minimum, it provides a reliable single-packet denial of service that kills localization and halts all navigation."}, {"lang": "es", "value": "navigation2 es un Framework y Sistema de Navegaci\u00f3n de ROS 2. En 1.3.11 y versiones anteriores, existe una vulnerabilidad cr\u00edtica de escritura fuera de l\u00edmites en el heap en la l\u00f3gica de agrupamiento del filtro de part\u00edculas de Nav2 AMCL. Al publicar un \u00fanico mensaje manipulado geometry_msgs/PoseWithCovarianceStamped con valores de covarianza extremos en el tema /initialpose, un atacante no autenticado en el mismo dominio DDS de ROS 2 puede desencadenar una escritura de \u00edndice negativo (set-&gt;clusters[-1]) en la memoria del heap que precede al b\u00fafer asignado. En las compilaciones de lanzamiento, la \u00fanica comprobaci\u00f3n de l\u00edmites (assert) se elimina en la compilaci\u00f3n, dejando cero protecci\u00f3n en tiempo de ejecuci\u00f3n. Esta primitiva permite la corrupci\u00f3n controlada de los metadatos del fragmento del heap (al menos el tama\u00f1o del fragmento del heap donde se encuentra set-&gt;clusters es controlable por el atacante), lo que podr\u00eda conducir a una explotaci\u00f3n posterior. Como m\u00ednimo, proporciona una denegaci\u00f3n de servicio fiable de un solo paquete que detiene la localizaci\u00f3n y toda la navegaci\u00f3n."}], "id": "CVE-2026-26011", "lastModified": "2026-06-17T10:25:35.697", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26011", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-13T17:14:36.872087Z", "version": "2.0.3"}}]}, "published": "2026-02-12T21:16:03.340", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/ros-navigation/navigation2/commit/d09ea82477ce9234678a6febf6890235e0a7ce12"}, {"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/ros-navigation/navigation2/releases/tag/1.3.11"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/ros-navigation/navigation2/security/advisories/GHSA-mgj5-g2p6-gc5x"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/ros-navigation/navigation2/security/advisories/GHSA-mgj5-g2p6-gc5x"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}, {"lang": "en", "value": "CWE-787"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.3.11]"}}], "product": "navigation2", "vendor": "ros-navigation"}], "analysis": {"en": {"generated_at": "2026-04-17T19:58:05.113512+00:00", "value": {"mitigation_remediation": ["Upgrade the navigation2 package to a release that includes the fix (v1.3.12 or newer).", "If an immediate upgrade is not possible, whitelist or limit the covariance values accepted on the /initialpose topic, or configure the node to reject messages with covariance outside a safe range.", "Remove or block the /initialpose topic from unauthorized publishers by isolating the ROS\u00a02 DDS domain or setting stricter transport security so only trusted nodes can publish to it."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "Version 1.3.11 and earlier of the ROS\u00a02 Navigation Framework (navigation2) from the vendor ros-navigation are affected. Users operating these releases on a ROS\u00a02 DDS domain that allows publishing to /initialpose are in scope.", "description_and_impact": "A heap out\u2011of\u2011bounds write occurs in the Nav2 AMCL particle filter clustering logic when an attacker publishes a PoseWithCovarianceStamped message to the /initialpose topic containing extreme covariance values. The malicious message causes the filtering code to compute a negative index and write before the allocated buffer, corrupting the heap chunk metadata. This primitive can be leveraged to overwrite protected heap fields and potentially lead to remote code execution; at minimum the flaw causes a reliable denial of service by killing localization and halting navigation.", "risk_and_exploitability": "The vulnerability has a CVSS base score of 9.3, indicating critical severity. The EPSS score is below 1%, suggesting that industrial exploitation is currently unlikely, and the issue is not listed in CISA\u2019s KEV catalog. However, the attack vector requires that the attacker has network access to the same ROS\u00a02 DDS domain and can publish to /initialpose; no authentication is required. Release builds compile out the only boundary check (an assert), leaving zero runtime protection. The described corruption of heap metadata provides a foothold for adversaries to achieve remote code execution, but even without that, the uncontrolled write results in a deterministic denial of service that stops all navigation processes."}}}}, "created": "2026-02-13T21:29:23.677626+00:00", "updated": "2026-04-17T20:00:09.040625+00:00", "vendors": ["ros-navigation", "ros-navigation$PRODUCT$navigation2"]}