CVE-2026-41907
Analyzed
Analyzed - Analysis Complete
BaseFortify
Vulnerability report for CVE-2026-41907, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-04-24
Last updated on: 2026-05-11
Assigner: GitHub, Inc.
Description
Description
uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| uuidjs | uuid | to 11.1.1 (exc) |
| uuidjs | uuid | 12.0.0 |
| uuidjs | uuid | 13.0.0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-823 | The product performs pointer arithmetic on a valid pointer, but it uses an offset that can point outside of the intended range of valid memory locations for the resulting pointer. |
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
