Read the docs
TI-2026-74152 Aliases CVE-2026-110661GHSA-c64r-37fg-rgvp

CGNS Stack Out-of-Bounds Read in ADFI_read_node_header

Priority LOW 21CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

CGNS through 4.5.2 contains a stack out-of-bounds read in ADFI_read_node_header. A crafted .cgns or .adf file with a non-NUL-terminated end tag makes ADFI_stridx_c scan past disk_node_data, which crashes tools such as cgnslist. The CVSS 4.0 base score is 4.8 (MEDIUM), with user interaction required and low availability impact.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

CGNS through 4.5.2 contains a stack out-of-bounds read vulnerability in ADFI_read_node_header that allows attackers to crash applications by supplying crafted ADF node headers. Attackers can craft .cgns or .adf files whose non-NUL-terminated end tag causes ADFI_stridx_c to scan past disk_node_data, crashing tools like cgnslist.

Why it matters now

EPSS 0.00165 5th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
CGNSCGNSup to 4.5.2—No fix listedCNA
  • CGNS VendorCGNS Affected up to 4.5.2 Fixed in — No fix listed CNA

Remediation

No fix is listed for CGNS through 4.5.2. Avoid opening .cgns or .adf files from untrusted sources until a fixed version is available. Red Hat lists one of its products as not affected.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-14 Threatist record created from CVE-2026-110661
  2. 2026-10-15 Alias added: GHSA-c64r-37fg-rgvp
  3. 2026-11-07 Affected versions changed · Red Hat
  4. 2026-11-07 CVSS score added · Red Hat

References

Exploit 1

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences