CVE-2026-122056: Openscap: one-byte heap buffer overflow in sds-compose may lead to denial-of-service
Published Nov 4, 2026
·Updated
A flaw was found in OpenSCAP. A heap-based buffer overflow can occur when processing a specially crafted Extensible Configuration Checklist Description Format (XCCDF) document using the sds-compose option. An attacker could exploit this vulnerability to corrupt memory, resulting in an application crash and a Denial of Service (DoS).
Other sources
When processing a crafted XCCDF document in sds-compose option the OpenSCAP package may face a one byte heap buffer overflow, which can lead to small heap metadata corruption resulting in a possible program crash and in Denial-of-Service as a result.
— Red Hat
Affected Software
1 affected component
OpenSCAP OpenSCAP
Event History
Nov 4, 2026
Data Sourced
via Red Hat·04:44 PM
DescriptionSeverityAffected Software
Nov 9, 2026
CVE Published
via MITRE·08:33 PM
Data Sourced
via MITRE·08:33 PM
DescriptionSeverityWeakness