CVE-2026-21399

Awaiting Analysis Awaiting Analysis - Queue

Heap-based Buffer Overflow in Intel Open VKL Library

Publication date: 2026-08-11

Last updated on: 2026-08-12

Assigner: Intel Corporation

Description

Heap-based buffer overflow for the Intel(R) Open Volume Kernel Library (Intel(R) Open VKL) library maintained by intel(R) before version 2.0.2 within Ring 3: User Applications may allow a denial of service. System software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-12

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-21399

EUVD

EUVD-2026-56515

Affected Vendors & Products

Vendor	Product	Version / Range
intel	open_volume_kernel_library	to 2.0.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

This is a heap-based buffer overflow in the Intel Open Volume Kernel Library (Open VKL) before version 2.0.2. It allows a local authenticated attacker to cause a denial of service via low-complexity attacks without special internal knowledge or user interaction.

Detection Guidance

Detection of this vulnerability requires checking the version of the Intel Open Volume Kernel Library (Open VKL) installed on your system. If the version is below 2.0.2, the system is vulnerable. Use commands like 'find / -name "libopenvkl*" 2>/dev/null' to locate the library and 'strings <library_path> | grep "2.0.2"' to check the version.

Impact Analysis

The vulnerability may lead to system crashes or instability, resulting in denial of service. It has high impact on system availability but no direct impact on confidentiality or integrity.

Compliance Impact

This vulnerability primarily impacts system availability due to a denial of service risk, which could disrupt services handling sensitive data. GDPR and HIPAA require maintaining data availability and integrity; a denial of service could violate these requirements. However, the specific impact depends on system configuration and mitigations in place.

Mitigation Strategies

Update the Intel Open Volume Kernel Library to version 2.0.2 or later to address the heap-based buffer overflow vulnerability.

Hi! I’m here to help you understand CVE-2026-21399. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70