CVE-2026-114038
Description
A flaw was found in device-mapper-multipath. A local user can trigger an out-of-bounds read by sending a command with a format string ending in a trailing percent character to the multipath daemon. This issue can allow the user to expose unintended daemon memory, leading to information disclosure, or cause the daemon to crash, resulting in a Denial of Service (DoS).
Statement
Red Hat Product Security has rated this vulnerability as having Moderate impact because an unprivileged local attacker can exploit it via the multipathd control socket to trigger a denial of service or leak limited process memory, without achieving code execution or elevated privileges. While the multipath daemon restricts administrative configuration commands to root, query commands such as path and map listings are accessible to unprivileged local users by default, exposing the custom format parser. Because the defect only causes an out-of-bounds heap read within the daemon's own address space and does not allow modifying system state, the blast radius remains constrained to local daemon availability and nondeterministic memory disclosure.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.1 | N/A | 5.1 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | None | N/A | None |
| Availability Impact | Low | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
cve.org: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Acknowledgements
This issue was discovered by Found by AISLE in partnership with Red Hat.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
