{"id":"CVE-2026-93433","published":"2026-09-21T21:17:17.847","lastModified":"2026-09-21T21:17:17.847","description":"A flaw was found in libstoragemgmt. An attacker with control over a local or virtual storage device could provide specially crafted SCSI (Small Computer System Interface) Vital Product Data (VPD) page 0x80 data. This malformed data, specifically an untrusted page length field, can lead to a stack buffer overflow in the `_sg_parse_vpd_80()` function during serial number parsing. Successful exploitation could result in a denial of service by crashing or destabilizing the process querying the serial number.","cvssScore":5.5,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-121"],"vendors":[],"products":[],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-93433","tags":[]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2465818","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw in libstoragemgmt allows an attacker to cause a stack buffer overflow by providing malformed SCSI VPD page 0x80 data, leading to potential denial of service.","exploitability":"Exploitation requires control over a local or virtual storage device and knowledge of crafting specific VPD data; it is moderately difficult.","blast_radius":"If exploited, the impact is limited to destabilizing the process querying the serial number, potentially causing a denial of service.","remediation":"Update libstoragemgmt to the latest version to patch the vulnerability.","tags":["buffer-overflow","dos","storage"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-22T06:25:03.518Z"}}