CVE-2026-71223

{}

{}

{}

{"acknowledgement": "Red Hat would like to thank Tristan Madani (Talence Security) for reporting this issue.", "bugzilla": {"description": "gfs2-utils: gfs2-utils: integer overflow in resource group allocation size on 32-bit platforms", "id": "2511400", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511400"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-190", "details": ["An integer overflow vulnerability was found in gfs2-utils. The resource group allocation size computation on 32-bit platforms causes an undersized buffer allocation followed by heap out-of-bounds writes when processing crafted GFS2 filesystem images. This vulnerability does not affect 64-bit builds."], "mitigation": {"lang": "en:us", "value": "Use 64-bit builds of gfs2-utils (default on all RHEL 8+ architectures). Do not build or run gfs2-utils in 32-bit mode when processing untrusted filesystem images."}, "name": "CVE-2026-71223", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "gfs2-utils", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "gfs2-utils", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "gfs2-utils", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-09-03T11:49:47Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-71223\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-71223"], "statement": "This vulnerability is assessed as Moderate impact because it requires a 32-bit platform to trigger. All standard RHEL 8+ architectures (x86_64, aarch64, ppc64le, s390x) are 64-bit and not affected. The vulnerability is applicable only to legacy 32-bit builds or embedded environments. On affected 32-bit platforms, the integer overflow leads to heap corruption with controlled writes, which could potentially enable code execution.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": ["32-bit"], "status": "affected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "product": "gfs2-utils", "vendor": "redhat"}], "created": "2026-09-04T01:30:04.516307+00:00", "updated": "2026-09-04T15:19:38.132156+00:00", "vendors": ["redhat", "redhat$PRODUCT$gfs2-utils"]}