AZL-113510: CVE-2026-28730 affecting package hyperscan 5.4.2-3
Null pointer dereference for some Hyperscan before version v5.4.2.1 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
hyperscanto a version that resolves this vulnerability.Fixed in v5.4.2.1
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems running affected Hyperscan versions before v5.4.2.1 are exposed when an unprivileged local user or local software can exercise the vulnerable functionality. The described impact is denial of service, with high availability impact and no stated confidentiality or integrity impact.
What does an attacker need to exploit it?
Exploitation requires local access by an unprivileged, unauthenticated user or software adversary. The attack is described as low complexity, requiring no user interaction and no special internal knowledge.