CVE-2026-45684
Memory Corruption in OpenTelemetry eBPF Instrumentation
Publication date: 2026-06-02
Last updated on: 2026-06-02
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| open_telemetry | opentelemetry_ebpf_instrumentation | From 0.7.0 (inc) to 0.9.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
| CWE-126 | The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in OpenTelemetry eBPF Instrumentation's log enricher can lead to memory corruption, potential leakage of memory into log events, and destabilization of the instrumented process. This impacts the confidentiality, integrity, and availability of the affected process.
Such impacts on confidentiality and integrity could pose risks to compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive data and system integrity. However, the vulnerability requires local access and has high attack complexity, which may limit its exploitability.
No explicit information is provided about direct compliance implications or mitigation steps related to these standards.
Can you explain this vulnerability to me?
The vulnerability CVE-2026-45684 affects the OpenTelemetry eBPF Instrumentation (OBI) log enricher in versions from 0.7.0 up to but not including 0.9.0. It occurs because the log enricher mishandles multi-segment writev calls by reading only the first iovec entry but using the total byte count from all segments when copying data. This mismatch causes the log enricher to read and overwrite memory beyond the first segment, leading to out-of-bounds memory access.
Specifically, the flaw lies in the `__fill_iov` function which resolves only the first segment, while the `__write` function uses the total byte count from the iterator. An attacker can exploit this by triggering a crafted multi-segment writev call within the instrumented process.
How can this vulnerability impact me? :
This vulnerability can impact the confidentiality, integrity, and availability of the affected process. It can cause memory corruption by overwriting memory beyond intended boundaries, potentially destabilizing the instrumented process.
Additionally, it can lead to leakage of memory contents into log events, which may expose sensitive information.
However, exploitation requires local access and has high attack complexity, meaning it is not easily exploitable without specific conditions.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability affects the OpenTelemetry eBPF Instrumentation (OBI) log enricher in versions greater than v0.7.0 and before v0.9.0. Detection involves identifying if the vulnerable versions of OBI are in use.
Since the issue is related to the handling of multi-segment writev calls causing memory corruption, direct detection on network traffic is unlikely. Instead, detection should focus on verifying the installed OBI version and monitoring for abnormal process behavior or memory corruption symptoms.
- Check the installed version of OpenTelemetry eBPF Instrumentation to confirm if it is between v0.7.0 and before v0.9.0.
- Use commands like `obi --version` or check package manager details depending on your installation method.
- Monitor logs and system behavior for signs of memory corruption or crashes in instrumented processes.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to upgrade the OpenTelemetry eBPF Instrumentation (OBI) to version 0.9.0 or later, where this vulnerability has been patched.
Since the vulnerability requires local access and has high attack complexity, limiting access to systems running vulnerable versions can reduce risk.
- Upgrade OBI to version 0.9.0 or newer.
- Restrict local access to trusted users only.
- Disable log injection features if immediate upgrade is not possible, to reduce the attack surface.