< Back

CVE-2026-111137

Updated on 15 Oct 2026

Severity

6.1 Medium severity

Details

CVSS score
6.1
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

libsmi through 0.5.0 contains an out-of-bounds write vulnerability in smiValueAsString() in lib/smi.c that allows attackers to overflow a fixed 1024-byte static buffer through hex rendering of OCTET STRING values. Attackers can supply a crafted MIB with an OCTET STRING DEFVAL of 512 or more octets and a leading 0x00 byte to corrupt adjacent library globals and crash smidump or other consumers.

Details

Affected product:
AlmaLinux 9.2 ESU , Debian 11 ELS , TuxCare 9.6 ESU , TuxCare 9.8 ESU , Ubuntu 18.04 ELS
Affected packages:
libsmi @ 0.4.8 (+4 more)