CVE-2026-111434
Received
Received - Intake
Format String Vulnerability in openEuler iSulad
Vulnerability report for CVE-2026-111434, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-12
Last updated on: 2026-11-12
Assigner: openEuler
Description
Description
Use of Externally-Controlled format string vulnerability in openEuler iSulad on Linux.
This vulnerability is associated with program file src/daemon/modules/image/oci/oci_load.c.
This issue affects iSulad: through 2.1.6.
When the iSulad daemon performs container lifecycle operations (such as create, start, exec, stop, etc.) through the isula runtime (shim), the daemon reads the stderr output of the shim process via a pipe for error information display. If the buffer contains format specifiers such as %s, %x, or %n, it may trigger a format string vulnerability, potentially leading to information leakage, denial of service, or the risk of arbitrary writes.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Currently, no data is known.
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-134 | The product uses a function that accepts a format string as an argument, but the format string originates from an external source. |
