CVE-2026-33849

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33849", "assignerOrgId": "1a37b84a-8e51-4525-b3d6-87e2fae01dbd", "state": "PUBLISHED", "assignerShortName": "GovTech CSG", "dateReserved": "2026-03-24T05:46:40.230Z", "datePublished": "2026-03-24T05:52:12.272Z", "dateUpdated": "2026-03-24T14:16:31.737Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1a37b84a-8e51-4525-b3d6-87e2fae01dbd", "shortName": "GovTech CSG", "dateUpdated": "2026-03-24T05:52:12.272Z"}, "title": "Improper Restriction of Operations within the Bounds of a Memory Buffer in linkingvision rapidvms", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-119", "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer", "type": "CWE"}]}], "affected": [{"vendor": "linkingvision", "product": "rapidvms", "collectionURL": "https://github.com/linkingvision/rapidvms", "versions": [{"status": "affected", "version": "0", "lessThan": "PR#96", "versionType": "git"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in linkingvision rapidvms.This issue affects rapidvms: before PR#96.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in linkingvision rapidvms.<p>This issue affects rapidvms: before PR#96.</p>"}]}], "references": [{"url": "https://github.com/linkingvision/rapidvms/pull/96", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}}], "credits": [{"lang": "en", "value": "TITAN Team (titancaproject@gmail.com)", "type": "reporter"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-24T14:16:19.567596Z", "id": "CVE-2026-33849", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T14:16:31.737Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33849", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-24T14:16:19.567596Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T14:16:25.411Z"}}], "cna": {"title": "Improper Restriction of Operations within the Bounds of a Memory Buffer in linkingvision rapidvms", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "TITAN Team (titancaproject@gmail.com)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "linkingvision", "product": "rapidvms", "versions": [{"status": "affected", "version": "0", "lessThan": "PR#96", "versionType": "git"}], "collectionURL": "https://github.com/linkingvision/rapidvms", "defaultStatus": "affected"}], "references": [{"url": "https://github.com/linkingvision/rapidvms/pull/96", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in linkingvision rapidvms.This issue affects rapidvms: before PR#96.", "supportingMedia": [{"type": "text/html", "value": "Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in linkingvision rapidvms.<p>This issue affects rapidvms: before PR#96.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-119", "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}], "providerMetadata": {"orgId": "1a37b84a-8e51-4525-b3d6-87e2fae01dbd", "shortName": "GovTech CSG", "dateUpdated": "2026-03-24T05:52:12.272Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33849", "state": "PUBLISHED", "dateUpdated": "2026-03-24T14:16:31.737Z", "dateReserved": "2026-03-24T05:46:40.230Z", "assignerOrgId": "1a37b84a-8e51-4525-b3d6-87e2fae01dbd", "datePublished": "2026-03-24T05:52:12.272Z", "assignerShortName": "GovTech CSG"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/linkingvision/rapidvms", "defaultStatus": "affected", "product": "rapidvms", "vendor": "linkingvision", "versions": [{"lessThan": "PR#96", "status": "affected", "version": "0", "versionType": "git"}]}], "source": "cve_disclosure@tech.gov.sg"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:linkingvision:rapidvms:-:*:*:*:*:*:*:*", "matchCriteriaId": "66ED8209-0138-4730-B63D-839D8B5DAB01", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in linkingvision rapidvms.This issue affects rapidvms: before PR#96."}, {"lang": "es", "value": "Restricci\u00f3n Inadecuada de Operaciones dentro de los L\u00edmites de un B\u00fafer de Memoria vulnerabilidad en linkingvision rapidvms. Este problema afecta a rapidvms: antes de PR#96."}], "id": "CVE-2026-33849", "lastModified": "2026-06-17T10:38:12.317", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "cve_disclosure@tech.gov.sg", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33849", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-24T14:16:19.567596Z", "version": "2.0.3"}}]}, "published": "2026-03-24T06:16:22.073", "references": [{"source": "cve_disclosure@tech.gov.sg", "tags": ["Issue Tracking"], "url": "https://github.com/linkingvision/rapidvms/pull/96"}], "sourceIdentifier": "cve_disclosure@tech.gov.sg", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}], "source": "cve_disclosure@tech.gov.sg", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,PR#96)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "rapidvms", "source": "cna", "vendor": "linkingvision"}, "product": "rapidvms", "vendor": "linkingvision"}], "analysis": {"en": {"generated_at": "2026-03-24T07:22:52.123201+00:00", "value": {"mitigation_remediation": ["Apply the patch provided in pull request #96 and upgrade RapidVMS to the latest version.", "If an immediate upgrade is not possible, restrict network access to the RapidVMS service to trusted hosts only.", "Monitor logs for anomalous memory usage or unexpected crashes indicative of exploitation attempts.", "Confirm patch application by verifying the RapidVMS build identifiers or commit information following the update."], "summary": {"action": "Immediate Patch", "impact": "Potential Code Execution via Memory Corruption"}, "threat_synthesis": {"affected_systems": "The affected product is linkingvision RapidVMS before the changes incorporated in pull request #96. No specific version numbers are listed in the data, so any deployment running a RapidVMS build generated prior to that pull request is potentially vulnerable.", "description_and_impact": "The vulnerability is an improper restriction of operations within the bounds of a memory buffer in the linkingvision RapidVMS application. This flaw allows an attacker to corrupt memory, potentially leading to arbitrary code execution or denial of service. The weakness is identified as CWE\u2011119 and is consistent with classic buffer overflow attacks that compromise confidentiality, integrity, or availability of the affected system.", "risk_and_exploitability": "The CVSS score is 8.8, indicating high severity. EPSS information is not available, and the vulnerability is not listed in CISA\u2019s KEV catalog. The likely attack vector is inferred to be remote, provided the affected component is exposed to an untrusted network, though the data does not explicitly state the vector. The absence of explicit remediation readiness suggests that exploitation could be practical in environments that have not applied the latest patch."}}}}, "created": "2026-03-24T10:28:53.093311+00:00", "updated": "2026-03-25T20:39:57.554972+00:00", "vendors": ["linkingvision", "linkingvision$PRODUCT$rapidvms"]}