CVE-2026-93165 (GCVE-0-2026-93165)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:11 – Updated: 2026-09-18 17:56
VLAI
Title
platform/chrome: sensorhub: Fix memory overread in ring handler
Summary
In the Linux kernel, the following vulnerability has been resolved: platform/chrome: sensorhub: Fix memory overread in ring handler `max_response` and `sensor_num` are read from different EC commands: - `max_response` is from cros_ec_get_proto_info(). ec_dev->max_response = info->max_response_packet_size - sizeof(struct ec_host_response); - `sensor_num` is from cros_ec_get_sensor_count(). sensor_num = cros_ec_get_sensor_count(ec); With a malfunctioning EC firmware, it is possible that the `msg->insize` (i.e., `fifo_info_length` in the context) could be clamped in cros_ec_cmd_xfer() because `msg->insize` is greater than `max_response`. int fifo_info_length = sizeof(struct ec_response_motion_sense_fifo_info) + sizeof(u16) * sensorhub->sensor_num; This means the number of read bytes could be less than expected. As a result, the subsequent memcpy() in cros_ec_sensorhub_ring_handler() overreads the `resp->fifo_info` buffer. Check the return value of cros_ec_cmd_xfer_status() and abort if the number of bytes read does not match the expected length.
Severity
7.7 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 145d59baff5944b71551ac518d7fd7d377a9c820 , < 98604cc8fd2578442f49cd113481e8fc83bc0ad3 (git)
Affected: 145d59baff5944b71551ac518d7fd7d377a9c820 , < 86bcfab7dff6f0a61cbe0660e5176e907353141b (git)
Affected: 145d59baff5944b71551ac518d7fd7d377a9c820 , < 7e901aaf95828364b05a2120a1bea1a1669bdc9a (git)
Affected: 145d59baff5944b71551ac518d7fd7d377a9c820 , < 7780d93ae28f31fe517417c9451255315d1ad584 (git)
Affected: 145d59baff5944b71551ac518d7fd7d377a9c820 , < ee0403520cdbcf87e853df9aaa9b518a0684ed38 (git)
Affected: 145d59baff5944b71551ac518d7fd7d377a9c820 , < 847a5ba0ac75f609e3f88da905251f7a76179145 (git)
Affected: 145d59baff5944b71551ac518d7fd7d377a9c820 , < 6268f46d83875d294d75b68b97a5b79953744598 (git)
Affected: 145d59baff5944b71551ac518d7fd7d377a9c820 , < d1ceb2b2324717fa30b44d56ef0c52813e239569 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.7
Unaffected: 0 , < 5.7 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/platform/chrome/cros_ec_sensorhub_ring.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "98604cc8fd2578442f49cd113481e8fc83bc0ad3",
              "status": "affected",
              "version": "145d59baff5944b71551ac518d7fd7d377a9c820",
              "versionType": "git"
            },
            {
              "lessThan": "86bcfab7dff6f0a61cbe0660e5176e907353141b",
              "status": "affected",
              "version": "145d59baff5944b71551ac518d7fd7d377a9c820",
              "versionType": "git"
            },
            {
              "lessThan": "7e901aaf95828364b05a2120a1bea1a1669bdc9a",
              "status": "affected",
              "version": "145d59baff5944b71551ac518d7fd7d377a9c820",
              "versionType": "git"
            },
            {
              "lessThan": "7780d93ae28f31fe517417c9451255315d1ad584",
              "status": "affected",
              "version": "145d59baff5944b71551ac518d7fd7d377a9c820",
              "versionType": "git"
            },
            {
              "lessThan": "ee0403520cdbcf87e853df9aaa9b518a0684ed38",
              "status": "affected",
              "version": "145d59baff5944b71551ac518d7fd7d377a9c820",
              "versionType": "git"
            },
            {
              "lessThan": "847a5ba0ac75f609e3f88da905251f7a76179145",
              "status": "affected",
              "version": "145d59baff5944b71551ac518d7fd7d377a9c820",
              "versionType": "git"
            },
            {
              "lessThan": "6268f46d83875d294d75b68b97a5b79953744598",
              "status": "affected",
              "version": "145d59baff5944b71551ac518d7fd7d377a9c820",
              "versionType": "git"
            },
            {
              "lessThan": "d1ceb2b2324717fa30b44d56ef0c52813e239569",
              "status": "affected",
              "version": "145d59baff5944b71551ac518d7fd7d377a9c820",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/platform/chrome/cros_ec_sensorhub_ring.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/chrome: sensorhub: Fix memory overread in ring handler\n\n`max_response` and `sensor_num` are read from different EC commands:\n\n- `max_response` is from cros_ec_get_proto_info().\n    ec_dev-\u003emax_response = info-\u003emax_response_packet_size -\n                                    sizeof(struct ec_host_response);\n\n- `sensor_num` is from cros_ec_get_sensor_count().\n    sensor_num = cros_ec_get_sensor_count(ec);\n\nWith a malfunctioning EC firmware, it is possible that the `msg-\u003einsize`\n(i.e., `fifo_info_length` in the context) could be clamped in\ncros_ec_cmd_xfer() because `msg-\u003einsize` is greater than `max_response`.\n\n    int fifo_info_length =\n            sizeof(struct ec_response_motion_sense_fifo_info) +\n            sizeof(u16) * sensorhub-\u003esensor_num;\n\nThis means the number of read bytes could be less than expected.  As a\nresult, the subsequent memcpy() in cros_ec_sensorhub_ring_handler()\noverreads the `resp-\u003efifo_info` buffer.\n\nCheck the return value of cros_ec_cmd_xfer_status() and abort if the\nnumber of bytes read does not match the expected length."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The MOTIONSENSE_CMD_FIFO_INFO bytes that cros_ec_sensorhub_ring_handler() memcpy()s, plus the mismatched max_response (cros_ec_get_proto_info) and sensor_num (MOTIONSENSE_CMD_DUMP via cros_ec_get_sensor_count), arrive from the on-board Chrome EC through cros_ec_irq_thread \u2192 event_notifier \u2192 cros_ec_sensorhub_event, not from a network protocol or pluggable USB device.\nAC:L - A compromised EC sets dump.sensor_count and GET_PROTOCOL_INFO max_response_packet_size so fifo_info_length exceeds max_response, then sends EC_MKBP_EVENT_SENSOR_FIFO with total_lost != 0. cros_ec_cmd_xfer() clamps insize and the memcpy of fifo_info_length then runs deterministically with no race.\nPR:N - cros_ec_sensorhub_ring_handler() runs from the MKBP IRQ notifier with no capable() or credential check. cros_ec_sensorhub_ring_add() calls cros_ec_sensorhub_ring_fifo_enable(true) at probe, so compromised EC firmware can trigger the FIFO_INFO overread without a host account.\nUI:N - FIFO interrupts are armed in cros_ec_sensorhub_ring_add() during driver probe; the EC_MKBP_EVENT_SENSOR_FIFO IRQ alone reaches the memcpy. No victim must open an IIO device, the cros_ec chardev, or take any other action.\nS:U - The overread is of the host kernel heap object allocated for sensorhub-\u003emsg in cros_ec_sensorhub_probe(); impact stays in the same kernel that runs the sensorhub driver, not a VM, IOMMU, or sandbox boundary.\nC:H - After clamping, memcpy(fifo_info, \u0026resp-\u003efifo_info, fifo_info_length) reads past the max_response-sized msg-\u003edata allocation into adjacent slab. With dump.sensor_count up to 255 that is hundreds of bytes of kernel heap, and fifo_info-\u003elost[] is later printed in the \"Sensor %d: lost: %d\" warning, not a few-byte leak.\nI:N - fifo_info is allocated fifo_info_length bytes in cros_ec_sensorhub_ring_allocate(), so the memcpy destination is in-bounds. fifo_info-\u003ecount/size are then checked against fifo_size before MOTIONSENSE_CMD_FIFO_READ; this is an overread only, with no OOB write or control-flow hijack.\nA:H - memcpy() of fifo_info_length past the probe kmalloc (sizeof(cros_ec_command)+max_response) can walk off the slab into unmapped or poisoned memory and oops. A malicious EC can report a tiny max_response and large sensor_count to make that overread hundreds of bytes from a small object."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:56:18.147Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/98604cc8fd2578442f49cd113481e8fc83bc0ad3"
        },
        {
          "url": "https://git.kernel.org/stable/c/86bcfab7dff6f0a61cbe0660e5176e907353141b"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e901aaf95828364b05a2120a1bea1a1669bdc9a"
        },
        {
          "url": "https://git.kernel.org/stable/c/7780d93ae28f31fe517417c9451255315d1ad584"
        },
        {
          "url": "https://git.kernel.org/stable/c/ee0403520cdbcf87e853df9aaa9b518a0684ed38"
        },
        {
          "url": "https://git.kernel.org/stable/c/847a5ba0ac75f609e3f88da905251f7a76179145"
        },
        {
          "url": "https://git.kernel.org/stable/c/6268f46d83875d294d75b68b97a5b79953744598"
        },
        {
          "url": "https://git.kernel.org/stable/c/d1ceb2b2324717fa30b44d56ef0c52813e239569"
        }
      ],
      "title": "platform/chrome: sensorhub: Fix memory overread in ring handler",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-93165",
    "datePublished": "2026-09-17T16:11:57.922Z",
    "dateReserved": "2026-09-17T16:02:15.090Z",
    "dateUpdated": "2026-09-18T17:56:18.147Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-93165",
      "date": "2026-09-25",
      "epss": "0.0019",
      "percentile": "0.07738"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/platform/chrome/cros_ec_sensorhub_ring.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "98604cc8fd2578442f49cd113481e8fc83bc0ad3",
                    "status": "affected",
                    "version": "145d59baff5944b71551ac518d7fd7d377a9c820",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "86bcfab7dff6f0a61cbe0660e5176e907353141b",
                    "status": "affected",
                    "version": "145d59baff5944b71551ac518d7fd7d377a9c820",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7e901aaf95828364b05a2120a1bea1a1669bdc9a",
                    "status": "affected",
                    "version": "145d59baff5944b71551ac518d7fd7d377a9c820",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7780d93ae28f31fe517417c9451255315d1ad584",
                    "status": "affected",
                    "version": "145d59baff5944b71551ac518d7fd7d377a9c820",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ee0403520cdbcf87e853df9aaa9b518a0684ed38",
                    "status": "affected",
                    "version": "145d59baff5944b71551ac518d7fd7d377a9c820",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "847a5ba0ac75f609e3f88da905251f7a76179145",
                    "status": "affected",
                    "version": "145d59baff5944b71551ac518d7fd7d377a9c820",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6268f46d83875d294d75b68b97a5b79953744598",
                    "status": "affected",
                    "version": "145d59baff5944b71551ac518d7fd7d377a9c820",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d1ceb2b2324717fa30b44d56ef0c52813e239569",
                    "status": "affected",
                    "version": "145d59baff5944b71551ac518d7fd7d377a9c820",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/platform/chrome/cros_ec_sensorhub_ring.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.7"
                  },
                  {
                    "lessThan": "5.7",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.270",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.221",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/chrome: sensorhub: Fix memory overread in ring handler\n\n`max_response` and `sensor_num` are read from different EC commands:\n\n- `max_response` is from cros_ec_get_proto_info().\n    ec_dev-\u003emax_response = info-\u003emax_response_packet_size -\n                                    sizeof(struct ec_host_response);\n\n- `sensor_num` is from cros_ec_get_sensor_count().\n    sensor_num = cros_ec_get_sensor_count(ec);\n\nWith a malfunctioning EC firmware, it is possible that the `msg-\u003einsize`\n(i.e., `fifo_info_length` in the context) could be clamped in\ncros_ec_cmd_xfer() because `msg-\u003einsize` is greater than `max_response`.\n\n    int fifo_info_length =\n            sizeof(struct ec_response_motion_sense_fifo_info) +\n            sizeof(u16) * sensorhub-\u003esensor_num;\n\nThis means the number of read bytes could be less than expected.  As a\nresult, the subsequent memcpy() in cros_ec_sensorhub_ring_handler()\noverreads the `resp-\u003efifo_info` buffer.\n\nCheck the return value of cros_ec_cmd_xfer_status() and abort if the\nnumber of bytes read does not match the expected length."
          }
        ],
        "id": "CVE-2026-93165",
        "lastModified": "2026-09-18T18:18:23.190",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.7,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:18:12.017",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6268f46d83875d294d75b68b97a5b79953744598"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7780d93ae28f31fe517417c9451255315d1ad584"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7e901aaf95828364b05a2120a1bea1a1669bdc9a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/847a5ba0ac75f609e3f88da905251f7a76179145"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/86bcfab7dff6f0a61cbe0660e5176e907353141b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/98604cc8fd2578442f49cd113481e8fc83bc0ad3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d1ceb2b2324717fa30b44d56ef0c52813e239569"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ee0403520cdbcf87e853df9aaa9b518a0684ed38"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-21T16:27:10Z",
      "cve": "CVE-2026-93165",
      "id": "CVE-2026-93165",
      "initial_release_date": "2026-09-18T00:11:18Z",
      "product_status:known_affected": "126",
      "product_status:known_not_affected": "221",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-93165",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-93165.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.