UBUNTU-CVE-2026-122056: Buffer Overflow
A flaw was found in OpenSCAP. A heap-based buffer overflow can occur when processing a specially crafted Extensible Configuration Checklist Description Format (XCCDF) document using the sds-compose option. An attacker could exploit this vulnerability to corrupt memory, resulting in an application crash and a Denial of Service (DoS).
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using OpenSCAP where an authenticated local user can invoke the sds-compose option on an attacker-controlled XCCDF document are exposed to the described denial-of-service impact.
What must an attacker do to trigger the flaw?
The attacker needs to provide a specially crafted XCCDF document for processing with the sds-compose option. The listed vector indicates network reachability but also requires low privileges, has high attack complexity, and does not require user interaction.
What is the documented impact?
Processing the crafted document can cause a heap-based buffer overflow and memory corruption, resulting in an OpenSCAP application crash and denial of service. The provided severity vector lists no confidentiality impact, low integrity impact, and high availability impact.