CVE-2026-93433

Received Received - Intake

Stack Buffer Overflow in libstoragemgmt via SCSI VPD Page 0x80

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: redhat-SADP

Description

A flaw was found in libstoragemgmt. An attacker with control over a local or virtual storage device could provide specially crafted SCSI (Small Computer System Interface) Vital Product Data (VPD) page 0x80 data. This malformed data, specifically an untrusted page length field, can lead to a stack buffer overflow in the `_sg_parse_vpd_80()` function during serial number parsing. Successful exploitation could result in a denial of service by crashing or destabilizing the process querying the serial number.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-21

Last Modified

2026-09-21

Generated

2026-09-22

AI Q&A

2026-09-22

EPSS Evaluated

N/A

NVD

CVE-2026-93433

EUVD

EUVD-2026-84117

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-121	A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

Executive Summary

This vulnerability is a stack buffer overflow flaw in libstoragemgmt. It occurs when an attacker controls a storage device and provides malformed SCSI VPD page 0x80 data with an untrusted page length field. This causes a buffer overflow in the _sg_parse_vpd_80() function during serial number parsing.

Detection Guidance

This vulnerability involves a stack buffer overflow in libstoragemgmt due to malformed SCSI VPD page 0x80 data. Detection requires checking for vulnerable versions of libstoragemgmt and monitoring for crashes or destabilization when querying storage device serial numbers. No specific commands are provided in the context to directly detect this issue.

Impact Analysis

An attacker could exploit this to crash or destabilize the process querying the storage device's serial number, leading to a denial of service. This requires local or virtual access to the storage device.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a local denial of service issue in libstoragemgmt. It does not involve unauthorized data access, disclosure, or processing violations that these regulations primarily address.

Mitigation Strategies

Update libstoragemgmt to the latest patched version to address the stack buffer overflow in _sg_parse_vpd_80(). Avoid using untrusted storage devices that could provide malformed SCSI VPD data.

Hi! I’m here to help you understand CVE-2026-93433. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70