Read the docs
TI-2026-81477 Aliases CVE-2026-108333GHSA-6gvh-cphr-573v

Use-after-free flaw in Tanium Threat Response Client Extension

Priority LOW 12CWE-416Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Tanium Endpoint Configuration Toolset Solution and threat-response-cx contain a use-after-free flaw (CWE-416) in which memory is accessed after it has been freed. A local user with low privileges and high attack complexity can affect availability. The flaw has no confidentiality or integrity impact.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

Tanium addressed a use-after-free vulnerability in Threat Response Client Extension.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00125 2nd percentileScored 2026-11-07
Fix Fixed Endpoint Configuration Toolset Solution (Tanium): 1.51.60, 1.59.50, 1.71.25threat-response-cx (Tanium): 1.17.802, 1.18.2732, 1.19.2213 +2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TaniumEndpoint Configuration Toolset Solution1.51 to before 1.51.60; 1.59 to before 1.59.50; 1.71 to before 1.71.251.51.60, 1.59.50, 1.71.25Patch availableCNA
Taniumthreat-response-cx1.17.802 to before 1.17.802; 1.18.2732 to before 1.18.2732; 1.19.2213 to before 1.19.2213; 1.20.2271 to before 1.20.2271; 1.21.1673 to before 1.21.16731.17.802, 1.18.2732, 1.19.2213, 1.20.2271, 1.21.1673Patch availableCNA
  • Endpoint Configuration Toolset Solution VendorTanium Affected 1.51 to before 1.51.60; 1.59 to before 1.59.50; 1.71 to before 1.71.25 Fixed in 1.51.60, 1.59.50, 1.71.25 Patch available CNA
  • threat-response-cx VendorTanium Affected 1.17.802 to before 1.17.802; 1.18.2732 to before 1.18.2732; 1.19.2213 to before 1.19.2213; 1.20.2271 to before 1.20.2271; 1.21.1673 to before 1.21.1673 Fixed in 1.17.802, 1.18.2732, 1.19.2213, 1.20.2271, 1.21.1673 Patch available CNA

Remediation

Update Tanium Endpoint Configuration Toolset Solution to 1.51.60, 1.59.50 or 1.71.25, and threat-response-cx to 1.17.802, 1.18.2732, 1.19.2213, 1.20.2271 or 1.21.1673.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA Endpoint Configuration Toolset Solution (Tanium) Fixed in 1.51.60, 1.59.50, 1.71.25
  • Fix · CNA threat-response-cx (Tanium) Fixed in 1.17.802, 1.18.2732, 1.19.2213, 1.20.2271, 1.21.1673

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Tanium Endpoint Configuration Toolset Solution 1.51.60, 1.59.50, 1.71.25

    10 records Highest priority Priority LOW 10 LOW

    Other records, highest priority first

    • TI-2026-81463 Heap-based buffer overflow in Tanium IndexPriority LOW 35
    • TI-2026-81462 Local privilege escalation in Tanium End-User NotificationsPriority LOW 35
    • TI-2026-81461 Local privilege escalation in Tanium End-User NotificationsPriority LOW 35
    Show all 10 records →
  • Release ·

    Tanium threat-response-cx 1.17.802, 1.18.2732 and 3 more versions

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2026-81476 Improper link resolution in Tanium Threat Response Client ExtensionPriority LOW 29
    • TI-2026-81474 Information disclosure in Tanium Threat Response Client ExtensionPriority LOW 16
    • TI-2026-81475 Uncontrolled recursion in Tanium Threat Response Client ExtensionPriority LOW 15
    Show all 4 records →

Timeline

  1. 2026-10-27 Threatist record created from CVE-2026-108333
  2. 2026-10-27 Alias added: GHSA-6gvh-cphr-573v
  3. 2026-11-04 CISA SSVC decision points changed

References

Other 1

  • TI-2026-81473 Unauthorized code execution in Tanium Threat Response CVSS 3.1HIGH 8.8
  • TI-2026-81459 Tanium Certificate Manager unauthorized code execution vulnerability CVSS 3.1HIGH 8.8
  • TI-2026-59476 Tanium addressed a SQL injection vulnerability in Threat Response. CVSS 3.1HIGH 8.8
  • TI-2026-08094 Tanium addressed an unauthorized code execution vulnerability in Connect. CVSS 3.1HIGH 8.8
  • TI-2026-08093 Tanium addressed an unauthorized code execution vulnerability in Connect. CVSS 3.1HIGH 8.8
  • TI-2025-13983 Tanium addressed an improper input validation vulnerability in Deploy. CVSS 3.1HIGH 8.8
See all 135 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences