CVE-2026-120740
Awaiting Analysis
Awaiting Analysis - Queue
Out-of-Bounds Memory Read in hivex via Malformed Registry Hive
Vulnerability report for CVE-2026-120740, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-02
Last updated on: 2026-11-02
Assigner: redhat-SADP
Description
Description
A flaw was found in hivex. By supplying a specially crafted Windows registry hive file, an attacker can trigger an out-of-bounds memory read when hivex parses registry values containing malformed large data block lists. This issue can cause the application processing the registry file to crash, resulting in a Denial of Service (DoS).
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | * |
| Red Hat | Red Hat Enterprise Linux 6 | * |
| Red Hat | Red Hat Enterprise Linux 7 | * |
| Red Hat | Red Hat Enterprise Linux 8 | * |
| Red Hat | Red Hat Enterprise Linux 9 | * |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
