{ "schemaVersion": "1.0", "publisher": "脆弱性ナビ", "origin": "https://zeijaku.ittrip.xyz", "terms": [ { "name": "CVE Program", "url": "https://www.cve.org/legal/termsofuse", "notice": "CVE content is used subject to the CVE Program Terms of Use. CVE is a trademark of The MITRE Corporation.", "licenseText": "CVE content: Copyright The MITRE Corporation. CVE is a trademark of The MITRE Corporation.\nCVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.\nDisclaimers: ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE." }, { "name": "NIST NVD", "url": "https://nvd.nist.gov/general/faq", "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD." }, { "name": "JVN", "url": "https://jvn.jp/contact/index.html", "notice": "出典：JVN（JPCERT/CC・IPA）。原文は各レコードの参照先を確認してください。" }, { "name": "CISA KEV", "url": "https://github.com/cisagov/kev-data", "notice": "Known Exploited Vulnerabilities catalog, CISA. CC0." } ], "records": [ { "id": "CVE-2008-4250", "aliases": [], "title": "n/a：コード実行", "summary": "Microsoft Windows の Server サービス（Windows 2000 SP4、XP SP2 および SP3、Server 2003 SP1 と SP2、Vista Gold と SP1、Server 2008、Windows 7 Pre‑Beta）において、細工された RPC 要求がパス正規化中にオーバーフローを引き起こし、リモートの攻撃者が任意のコードを実行できる脆弱性があります。この脆弱性は 2008 年 10 月に Gimmiv.A によって実際に悪用されました（「Server Service Vulnerability」）。", "risk": "リモートの攻撃者が対象サーバー上で任意のコードを実行できるため、システムが完全に制御される危険があります。", "product": "Microsoft Windows", "category": "windows", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "microsoft", "cvssVector": null, "affected": [ { "product": "n/a", "range": "n/a" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2008/4xxx/CVE-2008-4250.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2008-4250", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2008-4250", "label": "CVE公式レコード" }, { "url": "http://marc.info/?l=bugtraq&m=122703006921213&w=2", "label": "HPSBST02386" }, { "url": "http://secunia.com/advisories/32326", "label": "32326" }, { "url": "http://www.kb.cert.org/vuls/id/827267", "label": "VU#827267" }, { "url": "http://www.securitytracker.com/id?1021091", "label": "1021091" }, { "url": "https://www.exploit-db.com/exploits/7132", "label": "7132" }, { "url": "https://www.exploit-db.com/exploits/6841", "label": "6841" }, { "url": "http://www.securityfocus.com/bid/31874", "label": "31874" }, { "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-067", "label": "MS08-067" }, { "url": "http://blogs.securiteam.com/index.php/archives/1150", "label": "CVE掲載の参考情報" }, { "url": "https://learn.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-067", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-4250", "label": "CISAが示す関連情報" }, { "url": "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device", "label": "Microsoft公式：Windowsの情報を調べる" }, { "url": "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "label": "Microsoft公式：Windows Updateの操作" } ], "publishedAt": "2008-10-23T21:00:00.000Z", "modifiedAt": "2026-05-21T03:55:20.953Z", "fetchedAt": "2026-10-23T02:42:53.466Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary code via a crafted RPC request that triggers the overflow during path canonicalization, as exploited in the wild by Gimmiv.A in October 2008, aka \"Server Service Vulnerability.\"", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2008-4250", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2008/4xxx/CVE-2008-4250.json", "fetchedAt": "2026-10-23T02:42:53.466Z", "publishedAt": "2008-10-23T21:00:00.000Z", "modifiedAt": "2026-05-21T03:55:20.953Z", "state": "published", "provider": "microsoft", "title": "", "descriptions": [ { "lang": "en", "value": "The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary code via a crafted RPC request that triggers the overflow during path canonicalization, as exploited in the wild by Gimmiv.A in October 2008, aka \"Server Service Vulnerability.\"", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "n/a", "product": "n/a", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "n/a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "n/a", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "http://marc.info/?l=bugtraq&m=122703006921213&w=2", "label": "HPSBST02386", "tags": [ "vendor-advisory", "x_refsource_HP", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/7" }, { "url": "http://secunia.com/advisories/32326", "label": "32326", "tags": [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "http://www.kb.cert.org/vuls/id/827267", "label": "VU#827267", "tags": [ "third-party-advisory", "x_refsource_CERT-VN", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "http://www.securitytracker.com/id?1021091", "label": "1021091", "tags": [ "vdb-entry", "x_refsource_SECTRACK", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/3" }, { "url": "https://www.exploit-db.com/exploits/7132", "label": "7132", "tags": [ "exploit", "x_refsource_EXPLOIT-DB", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/4" }, { "url": "https://www.exploit-db.com/exploits/6841", "label": "6841", "tags": [ "exploit", "x_refsource_EXPLOIT-DB", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/5" }, { "url": "http://www.securityfocus.com/bid/31874", "label": "31874", "tags": [ "vdb-entry", "x_refsource_BID", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/6" }, { "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-067", "label": "MS08-067", "tags": [ "vendor-advisory", "x_refsource_MS", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/8" }, { "url": "http://blogs.securiteam.com/index.php/archives/1150", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/9" }, { "url": "https://www.exploit-db.com/exploits/6824", "label": "6824", "tags": [ "exploit", "x_refsource_EXPLOIT-DB", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/10" }, { "url": "http://www.vupen.com/english/advisories/2008/2902", "label": "ADV-2008-2902", "tags": [ "vdb-entry", "x_refsource_VUPEN", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/11" }, { "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46040", "label": "win-server-rpc-code-execution(46040)", "tags": [ "vdb-entry", "x_refsource_XF", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/12" }, { "url": "http://www.securityfocus.com/archive/1/497808/100/0/threaded", "label": "20081026 Windows RPC MS08-067 FAQ document released", "tags": [ "mailing-list", "x_refsource_BUGTRAQ", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/13" }, { "url": "http://www.us-cert.gov/cas/techalerts/TA08-297A.html", "label": "TA08-297A", "tags": [ "third-party-advisory", "x_refsource_CERT", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/14" }, { "url": "https://www.exploit-db.com/exploits/7104", "label": "7104", "tags": [ "exploit", "x_refsource_EXPLOIT-DB", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/15" }, { "url": "http://www.us-cert.gov/cas/techalerts/TA09-088A.html", "label": "TA09-088A", "tags": [ "third-party-advisory", "x_refsource_CERT", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/16" }, { "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6093", "label": "oval:org.mitre.oval:def:6093", "tags": [ "vdb-entry", "signature", "x_refsource_OVAL", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/17" }, { "url": "http://www.securityfocus.com/archive/1/497816/100/0/threaded", "label": "20081027 Windows RPC MS08-067 FAQ document updated", "tags": [ "mailing-list", "x_refsource_BUGTRAQ", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/18" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2008-4250", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2008/4xxx/CVE-2008-4250.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2008/4xxx/CVE-2008-4250.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary code via a crafted RPC request that triggers the overflow during path canonicalization, as exploited in the wild by Gimmiv.A in October 2008, aka \"Server Service Vulnerability.\"", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2008/4xxx/CVE-2008-4250.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"n/a\",\"lang\":\"en\",\"type\":\"text\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2008/4xxx/CVE-2008-4250.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":9.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"CRITICAL\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-05-21T03:55:20.953Z", "fetchedAt": "2026-10-23T02:42:53.466Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-05-20T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "n/aにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:23:37.104Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "5233a04b6f9aff619eb62a7155c1390179db0e76111048edb76fb422c08a65eb", "sourceModifiedAt": "2026-05-21T03:55:20.953Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Microsoft Windows の Server サービス（Windows 2000 SP4、XP SP2 および SP3、Server 2003 SP1 と SP2、Vista Gold と SP1、Server 2008、Windows 7 Pre‑Beta）において、細工された RPC 要求がパス正規化中にオーバーフローを引き起こし、リモートの攻撃者が任意のコードを実行できる脆弱性があります。この脆弱性は 2008 年 10 月に Gimmiv.A によって実際に悪用されました（「Server Service Vulnerability」）。", "risk": "リモートの攻撃者が対象サーバー上で任意のコードを実行できるため、システムが完全に制御される危険があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Windows 2000 SP4 の Server サービスが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2008/4xxx/CVE-2008-4250.json" ], "evidenceIds": [ "E1" ] }, { "text": "Windows XP SP2 の Server サービスが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2008/4xxx/CVE-2008-4250.json" ], "evidenceIds": [ "E1" ] }, { "text": "Windows XP SP3 の Server サービスが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2008/4xxx/CVE-2008-4250.json" ], "evidenceIds": [ "E1" ] }, { "text": "Windows Server 2003 SP1 の Server サービスが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2008/4xxx/CVE-2008-4250.json" ], "evidenceIds": [ "E1" ] }, { "text": "Windows Server 2003 SP2 の Server サービスが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2008/4xxx/CVE-2008-4250.json" ], "evidenceIds": [ "E1" ] }, { "text": "Windows Vista Gold の Server サービスが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2008/4xxx/CVE-2008-4250.json" ], "evidenceIds": [ "E1" ] }, { "text": "Windows Vista SP1 の Server サービスが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2008/4xxx/CVE-2008-4250.json" ], "evidenceIds": [ "E1" ] }, { "text": "Windows Server 2008 の Server サービスが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2008/4xxx/CVE-2008-4250.json" ], "evidenceIds": [ "E1" ] }, { "text": "Windows 7 Pre‑Beta の Server サービスが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2008/4xxx/CVE-2008-4250.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2008/4xxx/CVE-2008-4250.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2008-4250" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2008/4xxx/CVE-2008-4250.json" ], "evidenceIds": [ "E2" ] }, { "text": "「スタート」→「設定」→「システム」→「バージョン情報」を開き、Windowsのエディション・バージョン・OSビルドを控えます。会社のPCやサーバーは、この情報とCVE番号を管理担当者へ渡してください。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2008/4xxx/CVE-2008-4250.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "すぐ更新できない場合は、CVE番号、Windowsの版、業務で必要な機能を管理担当者に伝え、修正までの利用方法と更新予定を決めてください。すべてのWindowsの問題に同じ回避策が使えるわけではありません。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "https://www.cve.org/CVERecord?id=CVE-2008-4250", "http://marc.info/?l=bugtraq&m=122703006921213&w=2", "http://secunia.com/advisories/32326", "http://www.kb.cert.org/vuls/id/827267", "http://www.securitytracker.com/id?1021091", "https://www.exploit-db.com/exploits/7132", "https://www.exploit-db.com/exploits/6841", "http://www.securityfocus.com/bid/31874", "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-067", "http://blogs.securiteam.com/index.php/archives/1150", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2008-4250", "https://learn.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-067", "https://nvd.nist.gov/vuln/detail/CVE-2008-4250" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2008/4xxx/CVE-2008-4250.json" ], "evidenceIds": [ "E2" ] }, { "text": "再起動後にWindows Updateを開き直して失敗・再起動待ちがないか確認し、管理担当者にこのCVEに対応する修正の適用結果を確認してもらってください。「最新の状態」と出ても、別製品の更新やサポート外の版の修正を保証するものではありません。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2008/4xxx/CVE-2008-4250.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2008-4250", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2008-4250", "label": "CVE公式レコード" }, { "url": "http://marc.info/?l=bugtraq&m=122703006921213&w=2", "label": "HPSBST02386" }, { "url": "http://secunia.com/advisories/32326", "label": "32326" }, { "url": "http://www.kb.cert.org/vuls/id/827267", "label": "VU#827267" }, { "url": "http://www.securitytracker.com/id?1021091", "label": "1021091" }, { "url": "https://www.exploit-db.com/exploits/7132", "label": "7132" }, { "url": "https://www.exploit-db.com/exploits/6841", "label": "6841" }, { "url": "http://www.securityfocus.com/bid/31874", "label": "31874" }, { "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-067", "label": "MS08-067" }, { "url": "http://blogs.securiteam.com/index.php/archives/1150", "label": "CVE掲載の参考情報" }, { "url": "https://learn.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-067", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-4250", "label": "CISAが示す関連情報" }, { "url": "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device", "label": "Microsoft公式：Windowsの情報を調べる" }, { "url": "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "label": "Microsoft公式：Windows Updateの操作" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2008/4xxx/CVE-2008-4250.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary code via a crafted RPC request that triggers the overflow during path canonicalization, as exploited in the wild by Gimmiv.A in October 2008, aka \"Server Service Vulnerability.\"", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2008/4xxx/CVE-2008-4250.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2008-4250", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2008-4250\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2008-4250（Microsoft Windows）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Windows 2000 SP4 の Server サービスが影響を受けます。\n・Windows XP SP2 の Server サービスが影響を受けます。\n・Windows XP SP3 の Server サービスが影響を受けます。\n・Windows Server 2003 SP1 の Server サービスが影響を受けます。\n・Windows Server 2003 SP2 の Server サービスが影響を受けます。\n・Windows Vista Gold の Server サービスが影響を受けます。\n・Windows Vista SP1 の Server サービスが影響を受けます。\n・Windows Server 2008 の Server サービスが影響を受けます。\n・Windows 7 Pre‑Beta の Server サービスが影響を受けます。\n・公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2008-4250", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:23:37.104Z", "lastSuccess": "2026-10-23T03:23:37.104Z", "sourceCheckedAt": "2026-10-23T02:42:53.466Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2009-1537", "aliases": [], "title": "n/a：コード実行", "summary": "Microsoft DirectX の DirectShow に含まれる quartz.dll の QuickTime Movie Parser Filter に未特定の脆弱性があり、DirectX 7.0 から 9.0c まで、Windows 2000 SP4、Windows XP SP2 および SP3、Windows Server 2003 SP2 上で動作する環境で、細工された QuickTime メディアファイルを開くとリモートの攻撃者が任意のコードを実行できる可能性があります。この脆弱性は 2009 年 5 月に実際に悪用されたことが確認されています（「DirectX NULL Byte Overwrite Vulnerability」）。", "risk": "攻撃者が任意のコードを実行できるため、対象システムが制御される危険があります。", "product": "Microsoft DirectX", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "microsoft", "cvssVector": null, "affected": [ { "product": "n/a", "range": "n/a" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/1xxx/CVE-2009-1537.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-1537", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2009-1537", "label": "CVE公式レコード" }, { "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-028", "label": "MS09-028" }, { "url": "http://blogs.technet.com/srd/archive/2009/05/28/new-vulnerability-in-quicktime-parsing.aspx", "label": "CVE掲載の参考情報" }, { "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6237", "label": "oval:org.mitre.oval:def:6237" }, { "url": "http://secunia.com/advisories/35268", "label": "35268" }, { "url": "http://www.securitytracker.com/id?1022299", "label": "1022299" }, { "url": "http://www.vupen.com/english/advisories/2009/1886", "label": "ADV-2009-1886" }, { "url": "http://www.vupen.com/english/advisories/2009/1445", "label": "ADV-2009-1445" }, { "url": "http://osvdb.org/54797", "label": "54797" }, { "url": "http://www.securityfocus.com/bid/35139", "label": "35139" }, { "url": "http://www.us-cert.gov/cas/techalerts/TA09-195A.html", "label": "TA09-195A" }, { "url": "https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-028", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-1537", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2009-05-29T18:00:00.000Z", "modifiedAt": "2026-05-21T03:55:22.095Z", "fetchedAt": "2026-10-23T02:42:53.683Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2 allows remote attackers to execute arbitrary code via a crafted QuickTime media file, as exploited in the wild in May 2009, aka \"DirectX NULL Byte Overwrite Vulnerability.\"", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2009-1537", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/1xxx/CVE-2009-1537.json", "fetchedAt": "2026-10-23T02:42:53.683Z", "publishedAt": "2009-05-29T18:00:00.000Z", "modifiedAt": "2026-05-21T03:55:22.095Z", "state": "published", "provider": "microsoft", "title": "", "descriptions": [ { "lang": "en", "value": "Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2 allows remote attackers to execute arbitrary code via a crafted QuickTime media file, as exploited in the wild in May 2009, aka \"DirectX NULL Byte Overwrite Vulnerability.\"", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "n/a", "product": "n/a", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "n/a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "n/a", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-028", "label": "MS09-028", "tags": [ "vendor-advisory", "x_refsource_MS", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "http://blogs.technet.com/srd/archive/2009/05/28/new-vulnerability-in-quicktime-parsing.aspx", "label": "CVE", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6237", "label": "oval:org.mitre.oval:def:6237", "tags": [ "vdb-entry", "signature", "x_refsource_OVAL", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "http://secunia.com/advisories/35268", "label": "35268", "tags": [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/3" }, { "url": "http://www.securitytracker.com/id?1022299", "label": "1022299", "tags": [ "vdb-entry", "x_refsource_SECTRACK", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/4" }, { "url": "http://www.vupen.com/english/advisories/2009/1886", "label": "ADV-2009-1886", "tags": [ "vdb-entry", "x_refsource_VUPEN", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/5" }, { "url": "http://www.vupen.com/english/advisories/2009/1445", "label": "ADV-2009-1445", "tags": [ "vdb-entry", "x_refsource_VUPEN", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/6" }, { "url": "http://osvdb.org/54797", "label": "54797", "tags": [ "vdb-entry", "x_refsource_OSVDB", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/7" }, { "url": "http://www.securityfocus.com/bid/35139", "label": "35139", "tags": [ "vdb-entry", "x_refsource_BID", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/8" }, { "url": "http://www.us-cert.gov/cas/techalerts/TA09-195A.html", "label": "TA09-195A", "tags": [ "third-party-advisory", "x_refsource_CERT", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/9" }, { "url": "http://isc.sans.org/diary.html?storyid=6481", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/10" }, { "url": "http://www.microsoft.com/technet/security/advisory/971778.mspx", "label": "CVE", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/11" }, { "url": "http://blogs.technet.com/msrc/archive/2009/05/28/microsoft-security-advisory-971778-vulnerability-in-microsoft-directshow-released.aspx", "label": "CVE", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/12" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-1537", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/1xxx/CVE-2009-1537.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/1xxx/CVE-2009-1537.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2 allows remote attackers to execute arbitrary code via a crafted QuickTime media file, as exploited in the wild in May 2009, aka \"DirectX NULL Byte Overwrite Vulnerability.\"", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/1xxx/CVE-2009-1537.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"n/a\",\"lang\":\"en\",\"type\":\"text\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/1xxx/CVE-2009-1537.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":8.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-05-21T03:55:22.095Z", "fetchedAt": "2026-10-23T02:42:53.683Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-05-20T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "n/aにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:23:38.266Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "9dd2da1d24d95a74e1893b0875ffc18f46be355bfaf40962c5cede2b73a1be68", "sourceModifiedAt": "2026-05-21T03:55:22.095Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Microsoft DirectX の DirectShow に含まれる quartz.dll の QuickTime Movie Parser Filter に未特定の脆弱性があり、DirectX 7.0 から 9.0c まで、Windows 2000 SP4、Windows XP SP2 および SP3、Windows Server 2003 SP2 上で動作する環境で、細工された QuickTime メディアファイルを開くとリモートの攻撃者が任意のコードを実行できる可能性があります。この脆弱性は 2009 年 5 月に実際に悪用されたことが確認されています（「DirectX NULL Byte Overwrite Vulnerability」）。", "risk": "攻撃者が任意のコードを実行できるため、対象システムが制御される危険があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "影響を受ける製品は Microsoft DirectX のバージョン 7.0 から 9.0c までです。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/1xxx/CVE-2009-1537.json" ], "evidenceIds": [ "E1" ] }, { "text": "対象となるオペレーティングシステムは Windows 2000 SP4、Windows XP SP2 および SP3、Windows Server 2003 SP2 です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/1xxx/CVE-2009-1537.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/1xxx/CVE-2009-1537.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-1537" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/1xxx/CVE-2009-1537.json" ], "evidenceIds": [ "E2" ] }, { "text": "「Microsoft DirectX」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2009-1537", "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-028", "http://blogs.technet.com/srd/archive/2009/05/28/new-vulnerability-in-quicktime-parsing.aspx", "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6237", "http://secunia.com/advisories/35268", "http://www.securitytracker.com/id?1022299", "http://www.vupen.com/english/advisories/2009/1886", "http://www.vupen.com/english/advisories/2009/1445", "http://osvdb.org/54797", "http://www.securityfocus.com/bid/35139", "http://www.us-cert.gov/cas/techalerts/TA09-195A.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-1537", "https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-028", "https://nvd.nist.gov/vuln/detail/CVE-2009-1537" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/1xxx/CVE-2009-1537.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2009-1537", "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-028", "http://blogs.technet.com/srd/archive/2009/05/28/new-vulnerability-in-quicktime-parsing.aspx", "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6237", "http://secunia.com/advisories/35268", "http://www.securitytracker.com/id?1022299", "http://www.vupen.com/english/advisories/2009/1886", "http://www.vupen.com/english/advisories/2009/1445", "http://osvdb.org/54797", "http://www.securityfocus.com/bid/35139", "http://www.us-cert.gov/cas/techalerts/TA09-195A.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-1537", "https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-028", "https://nvd.nist.gov/vuln/detail/CVE-2009-1537" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/1xxx/CVE-2009-1537.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2009-1537", "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-028", "http://blogs.technet.com/srd/archive/2009/05/28/new-vulnerability-in-quicktime-parsing.aspx", "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6237", "http://secunia.com/advisories/35268", "http://www.securitytracker.com/id?1022299", "http://www.vupen.com/english/advisories/2009/1886", "http://www.vupen.com/english/advisories/2009/1445", "http://osvdb.org/54797", "http://www.securityfocus.com/bid/35139", "http://www.us-cert.gov/cas/techalerts/TA09-195A.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-1537", "https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-028", "https://nvd.nist.gov/vuln/detail/CVE-2009-1537" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/1xxx/CVE-2009-1537.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-1537", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2009-1537", "label": "CVE公式レコード" }, { "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-028", "label": "MS09-028" }, { "url": "http://blogs.technet.com/srd/archive/2009/05/28/new-vulnerability-in-quicktime-parsing.aspx", "label": "CVE掲載の参考情報" }, { "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6237", "label": "oval:org.mitre.oval:def:6237" }, { "url": "http://secunia.com/advisories/35268", "label": "35268" }, { "url": "http://www.securitytracker.com/id?1022299", "label": "1022299" }, { "url": "http://www.vupen.com/english/advisories/2009/1886", "label": "ADV-2009-1886" }, { "url": "http://www.vupen.com/english/advisories/2009/1445", "label": "ADV-2009-1445" }, { "url": "http://osvdb.org/54797", "label": "54797" }, { "url": "http://www.securityfocus.com/bid/35139", "label": "35139" }, { "url": "http://www.us-cert.gov/cas/techalerts/TA09-195A.html", "label": "TA09-195A" }, { "url": "https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-028", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-1537", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/1xxx/CVE-2009-1537.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2 allows remote attackers to execute arbitrary code via a crafted QuickTime media file, as exploited in the wild in May 2009, aka \"DirectX NULL Byte Overwrite Vulnerability.\"", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/1xxx/CVE-2009-1537.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-1537", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2009-1537\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2009-1537（Microsoft DirectX）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・影響を受ける製品は Microsoft DirectX のバージョン 7.0 から 9.0c までです。\n・対象となるオペレーティングシステムは Windows 2000 SP4、Windows XP SP2 および SP3、Windows Server 2003 SP2 です。\n・公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2009-1537", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:23:38.266Z", "lastSuccess": "2026-10-23T03:23:38.266Z", "sourceCheckedAt": "2026-10-23T02:42:53.683Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2009-3459", "aliases": [], "title": "n/a：コード実行", "summary": "Adobe Reader および Acrobat の 7.x 系は 7.1.4 未満、8.x 系は 8.1.7 未満、9.x 系は 9.2 未満において、PDF ファイルを細工することでヒープ上のバッファがオーバーフローし、リモートの攻撃者が任意のコードを実行できる脆弱性が存在します。この脆弱性は 2009 年 10 月に実際に悪用されたことが報告されています。", "risk": "攻撃者が任意のコードを実行できる可能性があります。", "product": "Adobe Acrobat and Reader", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "adobe", "cvssVector": null, "affected": [ { "product": "n/a", "range": "n/a" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/3xxx/CVE-2009-3459.json", "label": "CVE：adobe" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-3459", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2009-3459", "label": "CVE公式レコード" }, { "url": "http://secunia.com/advisories/36983", "label": "36983" }, { "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6534", "label": "oval:org.mitre.oval:def:6534" }, { "url": "http://www.us-cert.gov/cas/techalerts/TA09-286B.html", "label": "TA09-286B" }, { "url": "http://securitytracker.com/id?1023007", "label": "1023007" }, { "url": "http://www.adobe.com/support/security/bulletins/apsb09-15.html", "label": "CVE掲載の参考情報" }, { "url": "http://www.iss.net/threats/348.html", "label": "20091009 Adobe Acrobat and Acrobat Reader Remote Code Execution" }, { "url": "http://www.vupen.com/english/advisories/2009/2851", "label": "ADV-2009-2851" }, { "url": "http://isc.sans.org/diary.html?storyid=7300", "label": "CVE掲載の参考情報" }, { "url": "http://blogs.adobe.com/psirt/2009/10/adobe_reader_and_acrobat_issue_1.html", "label": "CVE掲載の参考情報" }, { "url": "http://www.securityfocus.com/bid/36600", "label": "36600" }, { "url": "https://www.cisa.gov/news-events/alerts/2009/10/13/adobe-reader-and-acrobat-vulnerabilities", "label": "CISAが示す関連情報" }, { "url": "https://web.archive.org/web/20120324170253/http://www.adobe.com/support/security/bulletins/apsb09-15.html#:~:text=CVE%2D2009%2D3459).-,NOTE%3A,-There%20are%20reports", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3459", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2009-10-13T10:00:00.000Z", "modifiedAt": "2026-05-21T03:55:27.999Z", "fetchedAt": "2026-10-23T02:42:53.893Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption, as exploited in the wild in October 2009. NOTE: some of these details are obtained from third party information.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2009-3459", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/3xxx/CVE-2009-3459.json", "fetchedAt": "2026-10-23T02:42:53.893Z", "publishedAt": "2009-10-13T10:00:00.000Z", "modifiedAt": "2026-05-21T03:55:27.999Z", "state": "published", "provider": "adobe", "title": "", "descriptions": [ { "lang": "en", "value": "Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption, as exploited in the wild in October 2009. NOTE: some of these details are obtained from third party information.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "n/a", "product": "n/a", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "n/a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "n/a", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "http://secunia.com/advisories/36983", "label": "36983", "tags": [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6534", "label": "oval:org.mitre.oval:def:6534", "tags": [ "vdb-entry", "signature", "x_refsource_OVAL", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "http://www.us-cert.gov/cas/techalerts/TA09-286B.html", "label": "TA09-286B", "tags": [ "third-party-advisory", "x_refsource_CERT", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "http://securitytracker.com/id?1023007", "label": "1023007", "tags": [ "vdb-entry", "x_refsource_SECTRACK", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/3" }, { "url": "http://www.adobe.com/support/security/bulletins/apsb09-15.html", "label": "CVE", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/4" }, { "url": "http://www.iss.net/threats/348.html", "label": "20091009 Adobe Acrobat and Acrobat Reader Remote Code Execution", "tags": [ "third-party-advisory", "x_refsource_ISS", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/5" }, { "url": "http://www.vupen.com/english/advisories/2009/2851", "label": "ADV-2009-2851", "tags": [ "vdb-entry", "x_refsource_VUPEN", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/6" }, { "url": "http://isc.sans.org/diary.html?storyid=7300", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/7" }, { "url": "http://blogs.adobe.com/psirt/2009/10/adobe_reader_and_acrobat_issue_1.html", "label": "CVE", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/8" }, { "url": "http://www.securityfocus.com/bid/36600", "label": "36600", "tags": [ "vdb-entry", "x_refsource_BID", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/9" }, { "url": "http://www.vupen.com/english/advisories/2009/2898", "label": "ADV-2009-2898", "tags": [ "vdb-entry", "x_refsource_VUPEN", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/10" }, { "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53691", "label": "adobe-reader-pdf-code-execution(53691)", "tags": [ "vdb-entry", "x_refsource_XF", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/11" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3459", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/3xxx/CVE-2009-3459.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/3xxx/CVE-2009-3459.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption, as exploited in the wild in October 2009. NOTE: some of these details are obtained from third party information.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/3xxx/CVE-2009-3459.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"n/a\",\"lang\":\"en\",\"type\":\"text\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/3xxx/CVE-2009-3459.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":8.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-05-21T03:55:27.999Z", "fetchedAt": "2026-10-23T02:42:53.893Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-05-20T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "n/aにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:23:38.898Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "bef00744cb6c555a12dc48cb4dcca8a09b21d73c3c1dc372f4a15595299d3638", "sourceModifiedAt": "2026-05-21T03:55:27.999Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Adobe Reader および Acrobat の 7.x 系は 7.1.4 未満、8.x 系は 8.1.7 未満、9.x 系は 9.2 未満において、PDF ファイルを細工することでヒープ上のバッファがオーバーフローし、リモートの攻撃者が任意のコードを実行できる脆弱性が存在します。この脆弱性は 2009 年 10 月に実際に悪用されたことが報告されています。", "risk": "攻撃者が任意のコードを実行できる可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Adobe Reader および Acrobat 7.x 系でバージョン 7.1.4 未満が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/3xxx/CVE-2009-3459.json" ], "evidenceIds": [ "E1" ] }, { "text": "Adobe Reader および Acrobat 8.x 系でバージョン 8.1.7 未満が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/3xxx/CVE-2009-3459.json" ], "evidenceIds": [ "E1" ] }, { "text": "Adobe Reader および Acrobat 9.x 系でバージョン 9.2 未満が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/3xxx/CVE-2009-3459.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/3xxx/CVE-2009-3459.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-3459" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/3xxx/CVE-2009-3459.json" ], "evidenceIds": [ "E2" ] }, { "text": "「Adobe Acrobat and Reader」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2009-3459", "http://secunia.com/advisories/36983", "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6534", "http://www.us-cert.gov/cas/techalerts/TA09-286B.html", "http://securitytracker.com/id?1023007", "http://www.adobe.com/support/security/bulletins/apsb09-15.html", "http://www.iss.net/threats/348.html", "http://www.vupen.com/english/advisories/2009/2851", "http://isc.sans.org/diary.html?storyid=7300", "http://blogs.adobe.com/psirt/2009/10/adobe_reader_and_acrobat_issue_1.html", "http://www.securityfocus.com/bid/36600", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-3459", "https://www.cisa.gov/news-events/alerts/2009/10/13/adobe-reader-and-acrobat-vulnerabilities", "https://web.archive.org/web/20120324170253/http://www.adobe.com/support/security/bulletins/apsb09-15.html#:~:text=CVE%2D2009%2D3459).-,NOTE%3A,-There%20are%20reports", "https://nvd.nist.gov/vuln/detail/CVE-2009-3459" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/3xxx/CVE-2009-3459.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2009-3459", "http://secunia.com/advisories/36983", "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6534", "http://www.us-cert.gov/cas/techalerts/TA09-286B.html", "http://securitytracker.com/id?1023007", "http://www.adobe.com/support/security/bulletins/apsb09-15.html", "http://www.iss.net/threats/348.html", "http://www.vupen.com/english/advisories/2009/2851", "http://isc.sans.org/diary.html?storyid=7300", "http://blogs.adobe.com/psirt/2009/10/adobe_reader_and_acrobat_issue_1.html", "http://www.securityfocus.com/bid/36600", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-3459", "https://www.cisa.gov/news-events/alerts/2009/10/13/adobe-reader-and-acrobat-vulnerabilities", "https://web.archive.org/web/20120324170253/http://www.adobe.com/support/security/bulletins/apsb09-15.html#:~:text=CVE%2D2009%2D3459).-,NOTE%3A,-There%20are%20reports", "https://nvd.nist.gov/vuln/detail/CVE-2009-3459" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/3xxx/CVE-2009-3459.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2009-3459", "http://secunia.com/advisories/36983", "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6534", "http://www.us-cert.gov/cas/techalerts/TA09-286B.html", "http://securitytracker.com/id?1023007", "http://www.adobe.com/support/security/bulletins/apsb09-15.html", "http://www.iss.net/threats/348.html", "http://www.vupen.com/english/advisories/2009/2851", "http://isc.sans.org/diary.html?storyid=7300", "http://blogs.adobe.com/psirt/2009/10/adobe_reader_and_acrobat_issue_1.html", "http://www.securityfocus.com/bid/36600", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-3459", "https://www.cisa.gov/news-events/alerts/2009/10/13/adobe-reader-and-acrobat-vulnerabilities", "https://web.archive.org/web/20120324170253/http://www.adobe.com/support/security/bulletins/apsb09-15.html#:~:text=CVE%2D2009%2D3459).-,NOTE%3A,-There%20are%20reports", "https://nvd.nist.gov/vuln/detail/CVE-2009-3459" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/3xxx/CVE-2009-3459.json", "label": "CVE：adobe" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-3459", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2009-3459", "label": "CVE公式レコード" }, { "url": "http://secunia.com/advisories/36983", "label": "36983" }, { "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6534", "label": "oval:org.mitre.oval:def:6534" }, { "url": "http://www.us-cert.gov/cas/techalerts/TA09-286B.html", "label": "TA09-286B" }, { "url": "http://securitytracker.com/id?1023007", "label": "1023007" }, { "url": "http://www.adobe.com/support/security/bulletins/apsb09-15.html", "label": "CVE掲載の参考情報" }, { "url": "http://www.iss.net/threats/348.html", "label": "20091009 Adobe Acrobat and Acrobat Reader Remote Code Execution" }, { "url": "http://www.vupen.com/english/advisories/2009/2851", "label": "ADV-2009-2851" }, { "url": "http://isc.sans.org/diary.html?storyid=7300", "label": "CVE掲載の参考情報" }, { "url": "http://blogs.adobe.com/psirt/2009/10/adobe_reader_and_acrobat_issue_1.html", "label": "CVE掲載の参考情報" }, { "url": "http://www.securityfocus.com/bid/36600", "label": "36600" }, { "url": "https://www.cisa.gov/news-events/alerts/2009/10/13/adobe-reader-and-acrobat-vulnerabilities", "label": "CISAが示す関連情報" }, { "url": "https://web.archive.org/web/20120324170253/http://www.adobe.com/support/security/bulletins/apsb09-15.html#:~:text=CVE%2D2009%2D3459).-,NOTE%3A,-There%20are%20reports", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3459", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/3xxx/CVE-2009-3459.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption, as exploited in the wild in October 2009. NOTE: some of these details are obtained from third party information.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2009/3xxx/CVE-2009-3459.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-3459", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2009-3459\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2009-3459（Adobe Acrobat and Reader）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Adobe Reader および Acrobat 7.x 系でバージョン 7.1.4 未満が影響を受けます。\n・Adobe Reader および Acrobat 8.x 系でバージョン 8.1.7 未満が影響を受けます。\n・Adobe Reader および Acrobat 9.x 系でバージョン 9.2 未満が影響を受けます。\n・公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2009-3459", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:23:38.898Z", "lastSuccess": "2026-10-23T03:23:38.898Z", "sourceCheckedAt": "2026-10-23T02:42:53.893Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2010-0249", "aliases": [], "title": "n/a：コード実行", "summary": "Microsoft Internet Explorer 6、6 SP1、7、8 が Windows 2000 SP4、Windows XP SP2 および SP3、Windows Server 2003 SP2、Windows Vista Gold、SP1、SP2、Windows Server 2008 Gold、SP2、R2、そして Windows 7 上で、削除されたオブジェクトに関連付けられたポインタにアクセスできるようになる Use‑after‑free の脆弱性が存在します。この脆弱性は、メモリが正しく初期化されていないことと、メモリ内のオブジェクトの不適切な取り扱いに起因し、2009 年 12 月と 2010 年 1 月に Operation Aurora（別名「HTML Object Memory Corruption Vulnerability」）として実際に悪用されました。", "risk": "リモートの攻撃者が任意のコードを実行できる可能性があります。", "product": "Microsoft Internet Explorer", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "microsoft", "cvssVector": null, "affected": [ { "product": "n/a", "range": "n/a" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2010/0xxx/CVE-2010-0249.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2010-0249", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2010-0249", "label": "CVE公式レコード" }, { "url": "http://www.microsoft.com/technet/security/advisory/979352.mspx", "label": "CVE掲載の参考情報" }, { "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6835", "label": "oval:org.mitre.oval:def:6835" }, { "url": "http://osvdb.org/61697", "label": "61697" }, { "url": "http://www.securityfocus.com/bid/37815", "label": "37815" }, { "url": "http://www.kb.cert.org/vuls/id/492515", "label": "VU#492515" }, { "url": "http://www.exploit-db.com/exploits/11167", "label": "11167" }, { "url": "http://support.microsoft.com/kb/979352", "label": "979352" }, { "url": "http://blogs.technet.com/msrc/archive/2010/01/14/security-advisory-979352.aspx", "label": "CVE掲載の参考情報" }, { "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/55642", "label": "ie-freed-object-code-execution(55642)" }, { "url": "http://www.us-cert.gov/cas/techalerts/TA10-055A.html", "label": "TA10-055A" }, { "url": "https://learn.microsoft.com/en-us/security-updates/SecurityAdvisories/2010/979352", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-0249", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2010-01-15T17:00:00.000Z", "modifiedAt": "2026-05-21T03:55:30.221Z", "fetchedAt": "2026-10-23T02:42:54.076Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Use-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows Vista Gold, SP1, and SP2; Windows Server 2008 Gold, SP2, and R2; and Windows 7 allows remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object, related to incorrectly initialized memory and improper handling of objects in memory, as exploited in the wild in December 2009 and January 2010 during Operation Aurora, aka \"HTML Object Memory Corruption Vulnerability.\"", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2010-0249", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2010/0xxx/CVE-2010-0249.json", "fetchedAt": "2026-10-23T02:42:54.076Z", "publishedAt": "2010-01-15T17:00:00.000Z", "modifiedAt": "2026-05-21T03:55:30.221Z", "state": "published", "provider": "microsoft", "title": "", "descriptions": [ { "lang": "en", "value": "Use-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows Vista Gold, SP1, and SP2; Windows Server 2008 Gold, SP2, and R2; and Windows 7 allows remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object, related to incorrectly initialized memory and improper handling of objects in memory, as exploited in the wild in December 2009 and January 2010 during Operation Aurora, aka \"HTML Object Memory Corruption Vulnerability.\"", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "n/a", "product": "n/a", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "n/a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "n/a", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "http://www.microsoft.com/technet/security/advisory/979352.mspx", "label": "CVE", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6835", "label": "oval:org.mitre.oval:def:6835", "tags": [ "vdb-entry", "signature", "x_refsource_OVAL", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "http://osvdb.org/61697", "label": "61697", "tags": [ "vdb-entry", "x_refsource_OSVDB", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "http://www.securityfocus.com/bid/37815", "label": "37815", "tags": [ "vdb-entry", "x_refsource_BID", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/3" }, { "url": "http://www.kb.cert.org/vuls/id/492515", "label": "VU#492515", "tags": [ "third-party-advisory", "x_refsource_CERT-VN", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/4" }, { "url": "http://www.exploit-db.com/exploits/11167", "label": "11167", "tags": [ "exploit", "x_refsource_EXPLOIT-DB", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/5" }, { "url": "http://support.microsoft.com/kb/979352", "label": "979352", "tags": [ "vendor-advisory", "x_refsource_MSKB", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/6" }, { "url": "http://blogs.technet.com/msrc/archive/2010/01/14/security-advisory-979352.aspx", "label": "CVE", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/7" }, { "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/55642", "label": "ie-freed-object-code-execution(55642)", "tags": [ "vdb-entry", "x_refsource_XF", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/8" }, { "url": "http://www.us-cert.gov/cas/techalerts/TA10-055A.html", "label": "TA10-055A", "tags": [ "third-party-advisory", "x_refsource_CERT", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/9" }, { "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-002", "label": "MS10-002", "tags": [ "vendor-advisory", "x_refsource_MS", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/10" }, { "url": "http://news.cnet.com/8301-27080_3-10435232-245.html", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/11" }, { "url": "http://securitytracker.com/id?1023462", "label": "1023462", "tags": [ "vdb-entry", "x_refsource_SECTRACK", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/12" }, { "url": "http://www.vupen.com/english/advisories/2010/0135", "label": "ADV-2010-0135", "tags": [ "vdb-entry", "x_refsource_VUPEN", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/13" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-0249", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2010/0xxx/CVE-2010-0249.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2010/0xxx/CVE-2010-0249.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Use-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows Vista Gold, SP1, and SP2; Windows Server 2008 Gold, SP2, and R2; and Windows 7 allows remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object, related to incorrectly initialized memory and improper handling of objects in memory, as exploited in the wild in December 2009 and January 2010 during Operation Aurora, aka \"HTML Object Memory Corruption Vulnerability.\"", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2010/0xxx/CVE-2010-0249.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"n/a\",\"lang\":\"en\",\"type\":\"text\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2010/0xxx/CVE-2010-0249.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":8.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-05-21T03:55:30.221Z", "fetchedAt": "2026-10-23T02:42:54.076Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-05-20T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "n/aにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:23:39.692Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "628660ea51fe8df51f6b62c2ef49f1d5b4651334fcbfa76969f00d086240df38", "sourceModifiedAt": "2026-05-21T03:55:30.221Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Microsoft Internet Explorer 6、6 SP1、7、8 が Windows 2000 SP4、Windows XP SP2 および SP3、Windows Server 2003 SP2、Windows Vista Gold、SP1、SP2、Windows Server 2008 Gold、SP2、R2、そして Windows 7 上で、削除されたオブジェクトに関連付けられたポインタにアクセスできるようになる Use‑after‑free の脆弱性が存在します。この脆弱性は、メモリが正しく初期化されていないことと、メモリ内のオブジェクトの不適切な取り扱いに起因し、2009 年 12 月と 2010 年 1 月に Operation Aurora（別名「HTML Object Memory Corruption Vulnerability」）として実際に悪用されました。", "risk": "リモートの攻撃者が任意のコードを実行できる可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "影響を受ける製品は Internet Explorer 6、6 SP1、7、8 で、対象 OS は Windows 2000 SP4、Windows XP SP2・SP3、Windows Server 2003 SP2、Windows Vista Gold・SP1・SP2、Windows Server 2008 Gold・SP2・R2、Windows 7 です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2010/0xxx/CVE-2010-0249.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2010/0xxx/CVE-2010-0249.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2010-0249" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2010/0xxx/CVE-2010-0249.json" ], "evidenceIds": [ "E2" ] }, { "text": "「Microsoft Internet Explorer」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2010-0249", "http://www.microsoft.com/technet/security/advisory/979352.mspx", "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6835", "http://osvdb.org/61697", "http://www.securityfocus.com/bid/37815", "http://www.kb.cert.org/vuls/id/492515", "http://www.exploit-db.com/exploits/11167", "http://support.microsoft.com/kb/979352", "http://blogs.technet.com/msrc/archive/2010/01/14/security-advisory-979352.aspx", "https://exchange.xforce.ibmcloud.com/vulnerabilities/55642", "http://www.us-cert.gov/cas/techalerts/TA10-055A.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2010-0249", "https://learn.microsoft.com/en-us/security-updates/SecurityAdvisories/2010/979352", "https://nvd.nist.gov/vuln/detail/CVE-2010-0249" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2010/0xxx/CVE-2010-0249.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2010-0249", "http://www.microsoft.com/technet/security/advisory/979352.mspx", "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6835", "http://osvdb.org/61697", "http://www.securityfocus.com/bid/37815", "http://www.kb.cert.org/vuls/id/492515", "http://www.exploit-db.com/exploits/11167", "http://support.microsoft.com/kb/979352", "http://blogs.technet.com/msrc/archive/2010/01/14/security-advisory-979352.aspx", "https://exchange.xforce.ibmcloud.com/vulnerabilities/55642", "http://www.us-cert.gov/cas/techalerts/TA10-055A.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2010-0249", "https://learn.microsoft.com/en-us/security-updates/SecurityAdvisories/2010/979352", "https://nvd.nist.gov/vuln/detail/CVE-2010-0249" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2010/0xxx/CVE-2010-0249.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2010-0249", "http://www.microsoft.com/technet/security/advisory/979352.mspx", "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6835", "http://osvdb.org/61697", "http://www.securityfocus.com/bid/37815", "http://www.kb.cert.org/vuls/id/492515", "http://www.exploit-db.com/exploits/11167", "http://support.microsoft.com/kb/979352", "http://blogs.technet.com/msrc/archive/2010/01/14/security-advisory-979352.aspx", "https://exchange.xforce.ibmcloud.com/vulnerabilities/55642", "http://www.us-cert.gov/cas/techalerts/TA10-055A.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2010-0249", "https://learn.microsoft.com/en-us/security-updates/SecurityAdvisories/2010/979352", "https://nvd.nist.gov/vuln/detail/CVE-2010-0249" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2010/0xxx/CVE-2010-0249.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2010-0249", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2010-0249", "label": "CVE公式レコード" }, { "url": "http://www.microsoft.com/technet/security/advisory/979352.mspx", "label": "CVE掲載の参考情報" }, { "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6835", "label": "oval:org.mitre.oval:def:6835" }, { "url": "http://osvdb.org/61697", "label": "61697" }, { "url": "http://www.securityfocus.com/bid/37815", "label": "37815" }, { "url": "http://www.kb.cert.org/vuls/id/492515", "label": "VU#492515" }, { "url": "http://www.exploit-db.com/exploits/11167", "label": "11167" }, { "url": "http://support.microsoft.com/kb/979352", "label": "979352" }, { "url": "http://blogs.technet.com/msrc/archive/2010/01/14/security-advisory-979352.aspx", "label": "CVE掲載の参考情報" }, { "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/55642", "label": "ie-freed-object-code-execution(55642)" }, { "url": "http://www.us-cert.gov/cas/techalerts/TA10-055A.html", "label": "TA10-055A" }, { "url": "https://learn.microsoft.com/en-us/security-updates/SecurityAdvisories/2010/979352", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-0249", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2010/0xxx/CVE-2010-0249.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Use-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows Vista Gold, SP1, and SP2; Windows Server 2008 Gold, SP2, and R2; and Windows 7 allows remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object, related to incorrectly initialized memory and improper handling of objects in memory, as exploited in the wild in December 2009 and January 2010 during Operation Aurora, aka \"HTML Object Memory Corruption Vulnerability.\"", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2010/0xxx/CVE-2010-0249.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2010-0249", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2010-0249\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2010-0249（Microsoft Internet Explorer）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・影響を受ける製品は Internet Explorer 6、6 SP1、7、8 で、対象 OS は Windows 2000 SP4、Windows XP SP2・SP3、Windows Server 2003 SP2、Windows Vista Gold・SP1・SP2、Windows Server 2008 Gold・SP2・R2、Windows 7 です。\n・公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2010-0249", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:23:39.692Z", "lastSuccess": "2026-10-23T03:23:39.692Z", "sourceCheckedAt": "2026-10-23T02:42:54.076Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2010-0806", "aliases": [], "title": "n/a：コード実行", "summary": "Microsoft Internet Explorer 6、6 SP1、7 の Peer Objects コンポーネント (iepeers.dll) において、オブジェクトが削除された後に無効なポインタへアクセスすることで発生する Use‑after‑free の脆弱性があり、リモートの攻撃者が任意のコードを実行できる可能性があります。この脆弱性は 2010 年 3 月に実際に悪用されたことが報告されています。", "risk": "攻撃者が対象のブラウザー上で任意のコードを実行できるため、システムが乗っ取られるなどの被害が生じる可能性があります。", "product": "Microsoft Internet Explorer", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "microsoft", "cvssVector": null, "affected": [ { "product": "n/a", "range": "n/a" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2010/0xxx/CVE-2010-0806.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2010-0806", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2010-0806", "label": "CVE公式レコード" }, { "url": "http://osvdb.org/62810", "label": "62810" }, { "url": "http://www.us-cert.gov/cas/techalerts/TA10-089A.html", "label": "TA10-089A" }, { "url": "http://www.securityfocus.com/bid/38615", "label": "38615" }, { "url": "http://www.vupen.com/english/advisories/2010/0567", "label": "ADV-2010-0567" }, { "url": "http://secunia.com/advisories/38860", "label": "38860" }, { "url": "http://www.us-cert.gov/cas/techalerts/TA10-068A.html", "label": "TA10-068A" }, { "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-018", "label": "MS10-018" }, { "url": "http://www.microsoft.com/technet/security/advisory/981374.mspx", "label": "CVE掲載の参考情報" }, { "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56772", "label": "ms-ie-useafterfree-code-execution(56772)" }, { "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8446", "label": "oval:org.mitre.oval:def:8446" }, { "url": "https://learn.microsoft.com/en-us/security-updates/securityadvisories/2010/981374", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-0806", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2010-03-10T22:00:00.000Z", "modifiedAt": "2026-05-21T03:55:29.109Z", "fetchedAt": "2026-10-23T02:42:54.115Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object, as exploited in the wild in March 2010, aka \"Uninitialized Memory Corruption Vulnerability.\"", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2010-0806", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2010/0xxx/CVE-2010-0806.json", "fetchedAt": "2026-10-23T02:42:54.115Z", "publishedAt": "2010-03-10T22:00:00.000Z", "modifiedAt": "2026-05-21T03:55:29.109Z", "state": "published", "provider": "microsoft", "title": "", "descriptions": [ { "lang": "en", "value": "Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object, as exploited in the wild in March 2010, aka \"Uninitialized Memory Corruption Vulnerability.\"", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "n/a", "product": "n/a", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "n/a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "n/a", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "http://osvdb.org/62810", "label": "62810", "tags": [ "vdb-entry", "x_refsource_OSVDB", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "http://www.us-cert.gov/cas/techalerts/TA10-089A.html", "label": "TA10-089A", "tags": [ "third-party-advisory", "x_refsource_CERT", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "http://www.securityfocus.com/bid/38615", "label": "38615", "tags": [ "vdb-entry", "x_refsource_BID", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "http://www.vupen.com/english/advisories/2010/0567", "label": "ADV-2010-0567", "tags": [ "vdb-entry", "x_refsource_VUPEN", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/3" }, { "url": "http://secunia.com/advisories/38860", "label": "38860", "tags": [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/4" }, { "url": "http://www.us-cert.gov/cas/techalerts/TA10-068A.html", "label": "TA10-068A", "tags": [ "third-party-advisory", "x_refsource_CERT", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/5" }, { "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-018", "label": "MS10-018", "tags": [ "vendor-advisory", "x_refsource_MS", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/6" }, { "url": "http://www.microsoft.com/technet/security/advisory/981374.mspx", "label": "CVE", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/7" }, { "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56772", "label": "ms-ie-useafterfree-code-execution(56772)", "tags": [ "vdb-entry", "x_refsource_XF", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/8" }, { "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8446", "label": "oval:org.mitre.oval:def:8446", "tags": [ "vdb-entry", "signature", "x_refsource_OVAL", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/9" }, { "url": "http://www.vupen.com/english/advisories/2010/0744", "label": "ADV-2010-0744", "tags": [ "vdb-entry", "x_refsource_VUPEN", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/10" }, { "url": "http://blogs.technet.com/msrc/archive/2010/03/09/security-advisory-981374-released.aspx", "label": "CVE", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/11" }, { "url": "http://www.kb.cert.org/vuls/id/744549", "label": "VU#744549", "tags": [ "third-party-advisory", "x_refsource_CERT-VN", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/12" }, { "url": "https://learn.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-018", "label": "CISA-ADP", "tags": [ "vendor-advisory" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-0806", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2010/0xxx/CVE-2010-0806.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2010/0xxx/CVE-2010-0806.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object, as exploited in the wild in March 2010, aka \"Uninitialized Memory Corruption Vulnerability.\"", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2010/0xxx/CVE-2010-0806.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"n/a\",\"lang\":\"en\",\"type\":\"text\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2010/0xxx/CVE-2010-0806.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":8.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-05-21T03:55:29.109Z", "fetchedAt": "2026-10-23T02:42:54.115Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-05-20T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "n/aにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:37:57.735Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "12c7030becff976906a3491924a8f19e2aecb9ae59a4984e2c8b519f36993025", "sourceModifiedAt": "2026-05-21T03:55:29.109Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Microsoft Internet Explorer 6、6 SP1、7 の Peer Objects コンポーネント (iepeers.dll) において、オブジェクトが削除された後に無効なポインタへアクセスすることで発生する Use‑after‑free の脆弱性があり、リモートの攻撃者が任意のコードを実行できる可能性があります。この脆弱性は 2010 年 3 月に実際に悪用されたことが報告されています。", "risk": "攻撃者が対象のブラウザー上で任意のコードを実行できるため、システムが乗っ取られるなどの被害が生じる可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2010/0xxx/CVE-2010-0806.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2010-0806" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2010/0xxx/CVE-2010-0806.json" ], "evidenceIds": [ "E2" ] }, { "text": "「Microsoft Internet Explorer」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2010-0806", "http://osvdb.org/62810", "http://www.us-cert.gov/cas/techalerts/TA10-089A.html", "http://www.securityfocus.com/bid/38615", "http://www.vupen.com/english/advisories/2010/0567", "http://secunia.com/advisories/38860", "http://www.us-cert.gov/cas/techalerts/TA10-068A.html", "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-018", "http://www.microsoft.com/technet/security/advisory/981374.mspx", "https://exchange.xforce.ibmcloud.com/vulnerabilities/56772", "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8446", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2010-0806", "https://learn.microsoft.com/en-us/security-updates/securityadvisories/2010/981374", "https://nvd.nist.gov/vuln/detail/CVE-2010-0806" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2010/0xxx/CVE-2010-0806.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2010-0806", "http://osvdb.org/62810", "http://www.us-cert.gov/cas/techalerts/TA10-089A.html", "http://www.securityfocus.com/bid/38615", "http://www.vupen.com/english/advisories/2010/0567", "http://secunia.com/advisories/38860", "http://www.us-cert.gov/cas/techalerts/TA10-068A.html", "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-018", "http://www.microsoft.com/technet/security/advisory/981374.mspx", "https://exchange.xforce.ibmcloud.com/vulnerabilities/56772", "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8446", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2010-0806", "https://learn.microsoft.com/en-us/security-updates/securityadvisories/2010/981374", "https://nvd.nist.gov/vuln/detail/CVE-2010-0806" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2010/0xxx/CVE-2010-0806.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2010-0806", "http://osvdb.org/62810", "http://www.us-cert.gov/cas/techalerts/TA10-089A.html", "http://www.securityfocus.com/bid/38615", "http://www.vupen.com/english/advisories/2010/0567", "http://secunia.com/advisories/38860", "http://www.us-cert.gov/cas/techalerts/TA10-068A.html", "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-018", "http://www.microsoft.com/technet/security/advisory/981374.mspx", "https://exchange.xforce.ibmcloud.com/vulnerabilities/56772", "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8446", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2010-0806", "https://learn.microsoft.com/en-us/security-updates/securityadvisories/2010/981374", "https://nvd.nist.gov/vuln/detail/CVE-2010-0806" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2010/0xxx/CVE-2010-0806.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2010-0806", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2010-0806", "label": "CVE公式レコード" }, { "url": "http://osvdb.org/62810", "label": "62810" }, { "url": "http://www.us-cert.gov/cas/techalerts/TA10-089A.html", "label": "TA10-089A" }, { "url": "http://www.securityfocus.com/bid/38615", "label": "38615" }, { "url": "http://www.vupen.com/english/advisories/2010/0567", "label": "ADV-2010-0567" }, { "url": "http://secunia.com/advisories/38860", "label": "38860" }, { "url": "http://www.us-cert.gov/cas/techalerts/TA10-068A.html", "label": "TA10-068A" }, { "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-018", "label": "MS10-018" }, { "url": "http://www.microsoft.com/technet/security/advisory/981374.mspx", "label": "CVE掲載の参考情報" }, { "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56772", "label": "ms-ie-useafterfree-code-execution(56772)" }, { "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8446", "label": "oval:org.mitre.oval:def:8446" }, { "url": "https://learn.microsoft.com/en-us/security-updates/securityadvisories/2010/981374", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-0806", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2010/0xxx/CVE-2010-0806.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object, as exploited in the wild in March 2010, aka \"Uninitialized Memory Corruption Vulnerability.\"", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2010/0xxx/CVE-2010-0806.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2010-0806", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2010-0806\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2010-0806（Microsoft Internet Explorer）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2010-0806", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:37:57.735Z", "lastSuccess": "2026-10-23T03:37:57.735Z", "sourceCheckedAt": "2026-10-23T02:42:54.115Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-41091", "aliases": [], "title": "Microsoft Malware Protection Engine：権限の奪取", "summary": "Microsoft Defender のリンク解決の不備（リンクフォロー）により、認可された攻撃者がローカルで権限を昇格できる。", "risk": "攻撃者がローカルで権限を昇格できる可能性がある。", "product": "Microsoft Malware Protection Engine", "category": "other", "component": "package", "severity": "high", "cvss": 7.8, "cvssVersion": "3.1", "cvssSource": "microsoft", "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C", "affected": [ { "product": "Microsoft Malware Protection Engine", "range": ">= 1.1.0.0 / < 1.1.26040.8" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/41xxx/CVE-2026-41091.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-41091", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-41091", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41091", "label": "Microsoft Defender Elevation of Privilege Vulnerability" }, { "url": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-41091", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41091", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-05-20T13:09:13.634Z", "modifiedAt": "2026-08-10T15:13:49.938Z", "fetchedAt": "2026-10-23T02:43:48.785Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "", "sourceTitle": "Microsoft Defender Elevation of Privilege Vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Microsoft", "product": "Microsoft Malware Protection Engine", "versions": [ { "version": "1.1.0.0", "lessThan": "1.1.26040.8", "versionType": "custom", "status": "affected" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-41091", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/41xxx/CVE-2026-41091.json", "fetchedAt": "2026-10-23T02:43:48.785Z", "publishedAt": "2026-05-20T13:09:13.634Z", "modifiedAt": "2026-08-10T15:13:49.938Z", "state": "published", "provider": "microsoft", "title": "Microsoft Defender Elevation of Privilege Vulnerability", "descriptions": [ { "lang": "en-US", "value": "Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Microsoft", "product": "Microsoft Malware Protection Engine", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "1.1.0.0", "lessThan": "1.1.26040.8", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-59", "lang": "en-US", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C", "baseScore": 7.8, "baseSeverity": "HIGH", "provider": "microsoft", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41091", "label": "Microsoft Defender Elevation of Privilege Vulnerability", "tags": [ "vendor-advisory", "patch" ], "provider": "microsoft", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41091", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/41xxx/CVE-2026-41091.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft Malware Protection Engine\",\"versions\":[{\"version\":\"1.1.0.0\",\"lessThan\":\"1.1.26040.8\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/41xxx/CVE-2026-41091.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/41xxx/CVE-2026-41091.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"CWE-59: Improper Link Resolution Before File Access ('Link Following')\",\"lang\":\"en-US\",\"type\":\"CWE\",\"cweId\":\"CWE-59\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/41xxx/CVE-2026-41091.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"baseSeverity\":\"HIGH\",\"baseScore\":7.8,\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-08-10T15:13:49.938Z", "fetchedAt": "2026-10-23T02:43:48.785Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-05-20T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Microsoft Malware Protection Engineに権限の奪取に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来与えられていない権限で、操作される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:23:43.152Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "a32a9feca2e16af9ef4fcac0aba1fd950de8125e19680b9f7148fc695fd2fbf3", "sourceModifiedAt": "2026-08-10T15:13:49.938Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Microsoft Defender のリンク解決の不備（リンクフォロー）により、認可された攻撃者がローカルで権限を昇格できる。", "risk": "攻撃者がローカルで権限を昇格できる可能性がある。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Microsoft Malware Protection Engine のバージョン 1.1.0.0 以上 1.1.26040.8 未満が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/41xxx/CVE-2026-41091.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "認可された攻撃者がローカルでこの欠陥を利用できる。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/41xxx/CVE-2026-41091.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：Microsoft / Microsoft Malware Protection Engine。影響ありとして記載：1.1.0.0以上、1.1.26040.8未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/41xxx/CVE-2026-41091.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-41091" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/41xxx/CVE-2026-41091.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Microsoft Malware Protection Engine」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-41091", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41091", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-41091", "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-41091", "https://nvd.nist.gov/vuln/detail/CVE-2026-41091" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/41xxx/CVE-2026-41091.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-41091", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41091", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-41091", "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-41091", "https://nvd.nist.gov/vuln/detail/CVE-2026-41091" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/41xxx/CVE-2026-41091.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-41091", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41091", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-41091", "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-41091", "https://nvd.nist.gov/vuln/detail/CVE-2026-41091" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/41xxx/CVE-2026-41091.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-41091", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-41091", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41091", "label": "Microsoft Defender Elevation of Privilege Vulnerability" }, { "url": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-41091", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41091", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/41xxx/CVE-2026-41091.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally.", "language": "en-US", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/41xxx/CVE-2026-41091.json", "sourceField": "/containers/cna/title", "excerpt": "Microsoft Defender Elevation of Privilege Vulnerability", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/41xxx/CVE-2026-41091.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft Malware Protection Engine\",\"versions\":[{\"version\":\"1.1.0.0\",\"lessThan\":\"1.1.26040.8\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-41091", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-41091\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-41091（Microsoft Malware Protection Engine）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Microsoft Malware Protection Engine のバージョン 1.1.0.0 以上 1.1.26040.8 未満が影響を受ける。\n・認可された攻撃者がローカルでこの欠陥を利用できる。\n・公式の対象表：Microsoft / Microsoft Malware Protection Engine。影響ありとして記載：1.1.0.0以上、1.1.26040.8未満。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-41091", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:23:43.152Z", "lastSuccess": "2026-10-23T03:23:43.152Z", "sourceCheckedAt": "2026-10-23T02:43:48.785Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-45498", "aliases": [], "title": "Microsoft Defender Antimalware Platform：サービス停止", "summary": "Microsoft Defender Antimalware Platform において、サービスが利用できなくなる（Denial of Service）脆弱性が存在します。", "risk": "攻撃者がこの脆弱性を利用すると、Microsoft Defender の機能が停止し、保護が機能しなくなる可能性があります。", "product": "Microsoft Defender Antimalware Platform", "category": "other", "component": "package", "severity": "medium", "cvss": 4, "cvssVersion": "3.1", "cvssSource": "microsoft", "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C", "affected": [ { "product": "Microsoft Defender Antimalware Platform", "range": ">= 4.0.0.0 / < 4.18.26040.7" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/45xxx/CVE-2026-45498.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-45498", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-45498", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45498", "label": "Microsoft Defender Denial of Service Vulnerability" }, { "url": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-45498", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45498", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-05-20T13:09:12.903Z", "modifiedAt": "2026-08-10T15:13:18.090Z", "fetchedAt": "2026-10-23T02:43:49.027Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "", "sourceTitle": "Microsoft Defender Denial of Service Vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Microsoft", "product": "Microsoft Defender Antimalware Platform", "versions": [ { "version": "4.0.0.0", "lessThan": "4.18.26040.7", "versionType": "custom", "status": "affected" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-45498", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/45xxx/CVE-2026-45498.json", "fetchedAt": "2026-10-23T02:43:49.027Z", "publishedAt": "2026-05-20T13:09:12.903Z", "modifiedAt": "2026-08-10T15:13:18.090Z", "state": "published", "provider": "microsoft", "title": "Microsoft Defender Denial of Service Vulnerability", "descriptions": [ { "lang": "en-US", "value": "Microsoft Defender Denial of Service Vulnerability", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Microsoft", "product": "Microsoft Defender Antimalware Platform", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "4.0.0.0", "lessThan": "4.18.26040.7", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-400", "lang": "en-US", "description": "CWE-400: Uncontrolled Resource Consumption", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C", "baseScore": 4, "baseSeverity": "MEDIUM", "provider": "microsoft", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45498", "label": "Microsoft Defender Denial of Service Vulnerability", "tags": [ "vendor-advisory", "patch" ], "provider": "microsoft", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45498", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/45xxx/CVE-2026-45498.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft Defender Antimalware Platform\",\"versions\":[{\"version\":\"4.0.0.0\",\"lessThan\":\"4.18.26040.7\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/45xxx/CVE-2026-45498.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Microsoft Defender Denial of Service Vulnerability", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/45xxx/CVE-2026-45498.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"CWE-400: Uncontrolled Resource Consumption\",\"lang\":\"en-US\",\"type\":\"CWE\",\"cweId\":\"CWE-400\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/45xxx/CVE-2026-45498.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"baseSeverity\":\"MEDIUM\",\"baseScore\":4,\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-08-10T15:13:18.090Z", "fetchedAt": "2026-10-23T02:43:49.027Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-05-20T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Microsoft Defender Antimalware Platformにサービス停止に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "処理の停止や過大な負荷により、サービスを利用できなくなる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:23:43.467Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "c1d6c317c21405c5e89e3d44a52d39412a0f100ec6323f682b4174971ca2b52a", "sourceModifiedAt": "2026-08-10T15:13:18.090Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Microsoft Defender Antimalware Platform において、サービスが利用できなくなる（Denial of Service）脆弱性が存在します。", "risk": "攻撃者がこの脆弱性を利用すると、Microsoft Defender の機能が停止し、保護が機能しなくなる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Microsoft Defender Antimalware Platform のバージョン 4.0.0.0 から 4.18.26040.7 未満が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/45xxx/CVE-2026-45498.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "公式の対象表：Microsoft / Microsoft Defender Antimalware Platform。影響ありとして記載：4.0.0.0以上、4.18.26040.7未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/45xxx/CVE-2026-45498.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-45498" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/45xxx/CVE-2026-45498.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Microsoft Defender Antimalware Platform」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-45498", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45498", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-45498", "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-45498", "https://nvd.nist.gov/vuln/detail/CVE-2026-45498" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/45xxx/CVE-2026-45498.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-45498", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45498", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-45498", "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-45498", "https://nvd.nist.gov/vuln/detail/CVE-2026-45498" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/45xxx/CVE-2026-45498.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-45498", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45498", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-45498", "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-45498", "https://nvd.nist.gov/vuln/detail/CVE-2026-45498" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/45xxx/CVE-2026-45498.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-45498", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-45498", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45498", "label": "Microsoft Defender Denial of Service Vulnerability" }, { "url": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-45498", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45498", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/45xxx/CVE-2026-45498.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Microsoft Defender Denial of Service Vulnerability", "language": "en-US", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/45xxx/CVE-2026-45498.json", "sourceField": "/containers/cna/title", "excerpt": "Microsoft Defender Denial of Service Vulnerability", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/45xxx/CVE-2026-45498.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft Defender Antimalware Platform\",\"versions\":[{\"version\":\"4.0.0.0\",\"lessThan\":\"4.18.26040.7\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-45498", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-45498\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-45498（Microsoft Defender Antimalware Platform）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Microsoft Defender Antimalware Platform のバージョン 4.0.0.0 から 4.18.26040.7 未満が影響を受けます。\n・公式の対象表：Microsoft / Microsoft Defender Antimalware Platform。影響ありとして記載：4.0.0.0以上、4.18.26040.7未満。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-45498", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:23:43.467Z", "lastSuccess": "2026-10-23T03:23:43.467Z", "sourceCheckedAt": "2026-10-23T02:43:49.027Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-42897", "aliases": [], "title": "Microsoft Exchange Server 2016 Cumulative Update 23 / Microsoft Exchange Server 2019 Cumulative Update 14 / Microsoft Exchange Server 2019 Cumulative Update 15 / Microsoft Exchange Server Subscription Edition RTM：脆弱性情報", "summary": "Microsoft Exchange Server でウェブページ生成時に入力の中和が不適切に行われる（クロスサイトスクリプティング）ため、認可されていない攻撃者がネットワーク上でなりすましを行える。", "risk": "攻撃者がなりすましを行い、ユーザーやシステムを騙す可能性がある。", "product": "Microsoft Exchange Server 2016 Cumulative Update 23 / Microsoft Exchange Server 2019 Cumulative Update 14 / Microsoft Exchange Server 2019 Cumulative Update 15 / Microsoft Exchange Server Subscription Edition RTM", "category": "other", "component": "package", "severity": "high", "cvss": 8.1, "cvssVersion": "3.1", "cvssSource": "microsoft", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C", "affected": [ { "product": "Microsoft Exchange Server 2016 Cumulative Update 23", "range": ">= 15.01.0.0 / < 15.01.2507.069（環境: x64-based Systems）" }, { "product": "Microsoft Exchange Server 2019 Cumulative Update 14", "range": ">= 15.02.0.0 / < 15.02.1544.041（環境: x64-based Systems）" }, { "product": "Microsoft Exchange Server 2019 Cumulative Update 15", "range": ">= 15.02.0.0 / < 15.02.1748.046（環境: x64-based Systems）" }, { "product": "Microsoft Exchange Server Subscription Edition RTM", "range": ">= 15.02.0.0 / < 15.02.2562.043（環境: x64-based Systems）" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42897.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-42897", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-42897", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897", "label": "Microsoft Exchange Server Spoofing Vulnerability" }, { "url": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-42897", "label": "CISAが示す関連情報" }, { "url": "https://learn.microsoft.com/en-us/exchange/plan-and-deploy/post-installation-tasks/security-best-practices/exchange-emergency-mitigation-service", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42897", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-05-14T17:00:36.515Z", "modifiedAt": "2026-08-10T15:14:02.885Z", "fetchedAt": "2026-10-23T02:43:48.942Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "", "sourceTitle": "Microsoft Exchange Server Spoofing Vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Microsoft", "product": "Microsoft Exchange Server 2016 Cumulative Update 23", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "15.01.0.0", "lessThan": "15.01.2507.069", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Microsoft Exchange Server 2019 Cumulative Update 14", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "15.02.0.0", "lessThan": "15.02.1544.041", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Microsoft Exchange Server 2019 Cumulative Update 15", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "15.02.0.0", "lessThan": "15.02.1748.046", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Microsoft Exchange Server Subscription Edition RTM", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "15.02.0.0", "lessThan": "15.02.2562.043", "versionType": "custom", "status": "affected" } ] } ], "configurationNotes": "対象環境・機能: x64-based Systems。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-42897", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42897.json", "fetchedAt": "2026-10-23T02:43:48.942Z", "publishedAt": "2026-05-14T17:00:36.515Z", "modifiedAt": "2026-08-10T15:14:02.885Z", "state": "published", "provider": "microsoft", "title": "Microsoft Exchange Server Spoofing Vulnerability", "descriptions": [ { "lang": "en-US", "value": "Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Microsoft", "product": "Microsoft Exchange Server 2016 Cumulative Update 23", "sourcePath": "/containers/cna/affected/0", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "15.01.0.0", "lessThan": "15.01.2507.069", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Microsoft Exchange Server 2019 Cumulative Update 14", "sourcePath": "/containers/cna/affected/1", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "15.02.0.0", "lessThan": "15.02.1544.041", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Microsoft Exchange Server 2019 Cumulative Update 15", "sourcePath": "/containers/cna/affected/2", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "15.02.0.0", "lessThan": "15.02.1748.046", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Microsoft Exchange Server Subscription Edition RTM", "sourcePath": "/containers/cna/affected/3", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/3/versions/0", "version": "15.02.0.0", "lessThan": "15.02.2562.043", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-79", "lang": "en-US", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C", "baseScore": 8.1, "baseSeverity": "HIGH", "provider": "microsoft", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897", "label": "Microsoft Exchange Server Spoofing Vulnerability", "tags": [ "vendor-advisory", "patch" ], "provider": "microsoft", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42897", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42897.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft Exchange Server 2016 Cumulative Update 23\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"15.01.0.0\",\"lessThan\":\"15.01.2507.069\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42897.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft Exchange Server 2019 Cumulative Update 14\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"15.02.0.0\",\"lessThan\":\"15.02.1544.041\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42897.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft Exchange Server 2019 Cumulative Update 15\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"15.02.0.0\",\"lessThan\":\"15.02.1748.046\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42897.json", "sourcePath": "/containers/cna/affected/3", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft Exchange Server Subscription Edition RTM\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"15.02.0.0\",\"lessThan\":\"15.02.2562.043\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42897.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42897.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\",\"lang\":\"en-US\",\"type\":\"CWE\",\"cweId\":\"CWE-79\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42897.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"baseSeverity\":\"HIGH\",\"baseScore\":8.1,\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-08-10T15:14:02.885Z", "fetchedAt": "2026-10-23T02:43:48.942Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-05-15T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Microsoft Exchange Server 2016 Cumulative Update 23 / Microsoft Exchange Server 2019 Cumulative Update 14 / Microsoft Exchange Server 2019 Cumulative Update 15 / Microsoft Exchange Server Subscription Edition RTMに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:23:43.600Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "055fed26923bc2c66792e587d60b5d2f458c8fc5512e609ce649514533553820", "sourceModifiedAt": "2026-08-10T15:14:02.885Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Microsoft Exchange Server でウェブページ生成時に入力の中和が不適切に行われる（クロスサイトスクリプティング）ため、認可されていない攻撃者がネットワーク上でなりすましを行える。", "risk": "攻撃者がなりすましを行い、ユーザーやシステムを騙す可能性がある。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Microsoft Exchange Server 2016 Cumulative Update 23（バージョン 15.01.0.0 以上、15.01.2507.069 未満）の x64 ベースシステムは影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42897.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "Microsoft Exchange Server 2019 Cumulative Update 14（バージョン 15.02.0.0 以上、15.02.1544.041 未満）の x64 ベースシステムは影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42897.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "Microsoft Exchange Server 2019 Cumulative Update 15（バージョン 15.02.0.0 以上、15.02.1748.046 未満）の x64 ベースシステムは影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42897.json" ], "evidenceIds": [ "E5", "E2" ] }, { "text": "Microsoft Exchange Server Subscription Edition RTM（バージョン 15.02.0.0 以上、15.02.2562.043 未満）の x64 ベースシステムは影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42897.json" ], "evidenceIds": [ "E6", "E2" ] }, { "text": "公式の対象表：Microsoft / Microsoft Exchange Server 2016 Cumulative Update 23。影響ありとして記載：15.01.0.0以上、15.01.2507.069未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42897.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Microsoft / Microsoft Exchange Server 2019 Cumulative Update 14。影響ありとして記載：15.02.0.0以上、15.02.1544.041未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42897.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Microsoft / Microsoft Exchange Server 2019 Cumulative Update 15。影響ありとして記載：15.02.0.0以上、15.02.1748.046未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42897.json" ], "evidenceIds": [ "E5" ] }, { "text": "公式の対象表：Microsoft / Microsoft Exchange Server Subscription Edition RTM。影響ありとして記載：15.02.0.0以上、15.02.2562.043未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42897.json" ], "evidenceIds": [ "E6" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-42897" ], "evidenceIds": [ "E7" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42897.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Microsoft Exchange Server 2016 Cumulative Update 23 / Microsoft Exchange Server 2019 Cumulative Update 14 / Microsoft Exchange Server 2019 Cumulative Update 15 / Microsoft Exchange Server Subscription Edition RTM」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-42897", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-42897", "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-42897", "https://learn.microsoft.com/en-us/exchange/plan-and-deploy/post-installation-tasks/security-best-practices/exchange-emergency-mitigation-service", "https://nvd.nist.gov/vuln/detail/CVE-2026-42897" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42897.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-42897", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-42897", "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-42897", "https://learn.microsoft.com/en-us/exchange/plan-and-deploy/post-installation-tasks/security-best-practices/exchange-emergency-mitigation-service", "https://nvd.nist.gov/vuln/detail/CVE-2026-42897" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42897.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-42897", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-42897", "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-42897", "https://learn.microsoft.com/en-us/exchange/plan-and-deploy/post-installation-tasks/security-best-practices/exchange-emergency-mitigation-service", "https://nvd.nist.gov/vuln/detail/CVE-2026-42897" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42897.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-42897", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-42897", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897", "label": "Microsoft Exchange Server Spoofing Vulnerability" }, { "url": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-42897", "label": "CISAが示す関連情報" }, { "url": "https://learn.microsoft.com/en-us/exchange/plan-and-deploy/post-installation-tasks/security-best-practices/exchange-emergency-mitigation-service", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42897", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42897.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.", "language": "en-US", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42897.json", "sourceField": "/containers/cna/title", "excerpt": "Microsoft Exchange Server Spoofing Vulnerability", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42897.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft Exchange Server 2016 Cumulative Update 23\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"15.01.0.0\",\"lessThan\":\"15.01.2507.069\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42897.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft Exchange Server 2019 Cumulative Update 14\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"15.02.0.0\",\"lessThan\":\"15.02.1544.041\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42897.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft Exchange Server 2019 Cumulative Update 15\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"15.02.0.0\",\"lessThan\":\"15.02.1748.046\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42897.json", "sourceField": "/containers/cna/affected/3", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft Exchange Server Subscription Edition RTM\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"15.02.0.0\",\"lessThan\":\"15.02.2562.043\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E7", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-42897", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-42897\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-42897（Microsoft Exchange Server 2016 Cumulative Update 23 / Microsoft Exchange Server 2019 Cumulative Update 14 / Microsoft Exchange Server 2019 Cumulative Update 15 / Microsoft Exchange Server Subscription Edition RTM）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Microsoft Exchange Server 2016 Cumulative Update 23（バージョン 15.01.0.0 以上、15.01.2507.069 未満）の x64 ベースシステムは影響を受ける。\n・Microsoft Exchange Server 2019 Cumulative Update 14（バージョン 15.02.0.0 以上、15.02.1544.041 未満）の x64 ベースシステムは影響を受ける。\n・Microsoft Exchange Server 2019 Cumulative Update 15（バージョン 15.02.0.0 以上、15.02.1748.046 未満）の x64 ベースシステムは影響を受ける。\n・Microsoft Exchange Server Subscription Edition RTM（バージョン 15.02.0.0 以上、15.02.2562.043 未満）の x64 ベースシステムは影響を受ける。\n・公式の対象表：Microsoft / Microsoft Exchange Server 2016 Cumulative Update 23。影響ありとして記載：15.01.0.0以上、15.01.2507.069未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Microsoft Exchange Server 2019 Cumulative Update 14。影響ありとして記載：15.02.0.0以上、15.02.1544.041未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Microsoft Exchange Server 2019 Cumulative Update 15。影響ありとして記載：15.02.0.0以上、15.02.1748.046未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Microsoft Exchange Server Subscription Edition RTM。影響ありとして記載：15.02.0.0以上、15.02.2562.043未満。対象の環境：x64-based Systems\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-42897", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:23:43.600Z", "lastSuccess": "2026-10-23T03:23:43.600Z", "sourceCheckedAt": "2026-10-23T02:43:48.942Z", "errorCode": null }, "glossary": [ { "term": "XSS", "meaning": "ページに紛れ込ませた不正な処理が、ページを表示した人のブラウザーで動く問題です。誰が仕込めるか、どの画面を表示すると動くかが判断のポイントです。", "sourceUrl": "https://cwe.mitre.org/data/definitions/79.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-20182", "aliases": [], "title": "Cisco Catalyst SD-WAN Controller / Cisco Catalyst SD-WAN Manager：認証の回避", "summary": "Cisco Catalyst SD-WAN Controller（旧 SD‑WAN vSmart）・Cisco Catalyst SD‑WAN Manager（旧 SD‑WAN vManage）・Cisco Catalyst SD‑WAN Validator（旧 SD‑WAN vBond）のピア認証に不備があり、認証が正しく機能しません。この欠陥を利用して、認証されていないリモート攻撃者が細工したリクエストを送信すると、内部の高権限（ただし root ではない）ユーザーとしてログインでき、NETCONF にアクセスして SD‑WAN ファブリックのネットワーク設定を操作できる可能性があります。", "risk": "攻撃者が認証を回避して管理者権限を取得し、NETCONF を通じて SD‑WAN のネットワーク構成を不正に変更できる恐れがあります。", "product": "Cisco Catalyst SD-WAN Controller / Cisco Catalyst SD-WAN Manager", "category": "other", "component": "package", "severity": "critical", "cvss": 10, "cvssVersion": "3.1", "cvssSource": "cisco", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "affected": [ { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.6.4" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.9.2" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.3.6" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.7.2" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.7.1" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.5.1" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.6.2" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "19.3.0" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.6.1" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "17.2.4" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "18.2.0" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "18.4.6" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "19.1.0" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "19.2.4" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "19.2.929" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "18.3.8" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "18.4.303" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "18.3.7" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "18.4.1" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "19.2.097" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "19.2.0" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "19.2.099" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "18.3.6" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.4.2" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "19.0.0" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.9.1" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.3.5" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.3.1" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "18.3.5" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.6.3" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "18.4.3" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "18.4.4" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "18.3.3" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "17.2.8" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.8.1" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "19.2.32" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "19.2.2" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "17.2.5" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "18.4.0" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.4.1.1" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.1.3" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.1.2" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "17.2.10" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "19.2.098" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.1.1" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "17.2.6" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "19.2.1" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "18.3.4" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.4.1" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "17.2.9" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "19.2.31" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "19.0.1a" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "18.3.0" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "17.2.7" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "18.4.5" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.3.4" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.3.3" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.4.1.2" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.3.2" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "18.3.1" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.1.12" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "19.2.3" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.10.1" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.6.5" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.3.7" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.9.3" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.11.1" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.6.3.2" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.4.2.3" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.3.5.1" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.3.4.3" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.9.3.1" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.6.4.1" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.3.3.2" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.6.5.2" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.3.7.1" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.11.1.1" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.10.1.1" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.6.1.2" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.1.3.1" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.9.2.2" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.6.5.3" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.6.3.3" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.3.7.2" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.6.5.4" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.9.2.3" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.9.4" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.12.1" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.3.8" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.6.6" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.12.2" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.13.1" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.9.5" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.12.3" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.6.7" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.9.5.1" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.14.1" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.12.3.1" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.12.4" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.15.1" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.9.6" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.6.8" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.16.1" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.9.5.3" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.12.4.1" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.15.2" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.12.5" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.9.7" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.15.3" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.12.5.1" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.12.5.2" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.15.4" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.9.7.1" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.12.6" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.9.8" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.15.4.1" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.15.4.2" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.12.5.3" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.12.6.1" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.9.8.2" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.15.5" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.12.7" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.9.9" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.15.5.1" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.15.4.3" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.15.4.5" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.15.5.3" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.12.7.2" }, { "product": "Cisco Catalyst SD-WAN Controller", "range": "20.9.9.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.1.12" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.2.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.4.4" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.4.5" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.1.1.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.1.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.2.099" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.3.6" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.3.7" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.2.0" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.1.0" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.4.303" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.2.098" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.3.6.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.2.0" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "17.2.8" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.3.3.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.4.0" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.3.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "17.2.6" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "17.2.9" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "17.2.5" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.4.0.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.3.3" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.3.0" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.2.3" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.4.501_ES" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.1.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.2.929" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.2.31" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.2.4" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.2.4.0.9" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.1.3.1" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20182.json", "label": "CVE：cisco" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20182", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-20182", "label": "CVE公式レコード" }, { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW", "label": "CISAが示す関連情報" }, { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk", "label": "Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability was disclosed in February 2026. This new adviso" }, { "url": "https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20182", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-05-14T16:08:25.566Z", "modifiedAt": "2026-06-16T17:57:59.048Z", "fetchedAt": "2026-10-23T02:43:47.354Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection handshaking. The section of this advisory includes Show Control Connections guidance to help with system checks. \r\n\r\nA vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.\r\nThis vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to the affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.", "sourceTitle": "Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Cisco", "product": "Cisco Catalyst SD-WAN Controller", "versions": [ { "version": "20.6.4", "status": "affected" }, { "version": "20.9.2", "status": "affected" }, { "version": "20.3.6", "status": "affected" }, { "version": "20.7.2", "status": "affected" }, { "version": "20.7.1", "status": "affected" }, { "version": "20.5.1", "status": "affected" }, { "version": "20.6.2", "status": "affected" }, { "version": "19.3.0", "status": "affected" }, { "version": "20.6.1", "status": "affected" }, { "version": "17.2.4", "status": "affected" }, { "version": "18.2.0", "status": "affected" }, { "version": "18.4.6", "status": "affected" }, { "version": "19.1.0", "status": "affected" }, { "version": "19.2.4", "status": "affected" }, { "version": "19.2.929", "status": "affected" }, { "version": "18.3.8", "status": "affected" }, { "version": "18.4.303", "status": "affected" }, { "version": "18.3.7", "status": "affected" }, { "version": "18.4.1", "status": "affected" }, { "version": "19.2.097", "status": "affected" }, { "version": "19.2.0", "status": "affected" }, { "version": "19.2.099", "status": "affected" }, { "version": "18.3.6", "status": "affected" }, { "version": "20.4.2", "status": "affected" }, { "version": "19.0.0", "status": "affected" }, { "version": "20.9.1", "status": "affected" }, { "version": "20.3.5", "status": "affected" }, { "version": "20.3.1", "status": "affected" }, { "version": "18.3.5", "status": "affected" }, { "version": "20.6.3", "status": "affected" }, { "version": "18.4.3", "status": "affected" }, { "version": "18.4.4", "status": "affected" }, { "version": "18.3.3", "status": "affected" }, { "version": "17.2.8", "status": "affected" }, { "version": "20.8.1", "status": "affected" }, { "version": "19.2.32", "status": "affected" }, { "version": "19.2.2", "status": "affected" }, { "version": "17.2.5", "status": "affected" }, { "version": "18.4.0", "status": "affected" }, { "version": "20.4.1.1", "status": "affected" }, { "version": "20.1.3", "status": "affected" }, { "version": "20.1.2", "status": "affected" }, { "version": "17.2.10", "status": "affected" }, { "version": "19.2.098", "status": "affected" }, { "version": "20.1.1", "status": "affected" }, { "version": "17.2.6", "status": "affected" }, { "version": "19.2.1", "status": "affected" }, { "version": "18.3.4", "status": "affected" }, { "version": "20.4.1", "status": "affected" }, { "version": "17.2.9", "status": "affected" }, { "version": "19.2.31", "status": "affected" }, { "version": "19.0.1a", "status": "affected" }, { "version": "18.3.0", "status": "affected" }, { "version": "17.2.7", "status": "affected" }, { "version": "18.4.5", "status": "affected" }, { "version": "20.3.4", "status": "affected" }, { "version": "20.3.3", "status": "affected" }, { "version": "20.4.1.2", "status": "affected" }, { "version": "20.3.2", "status": "affected" }, { "version": "18.3.1", "status": "affected" }, { "version": "20.1.12", "status": "affected" }, { "version": "19.2.3", "status": "affected" }, { "version": "20.10.1", "status": "affected" }, { "version": "20.6.5", "status": "affected" }, { "version": "20.3.7", "status": "affected" }, { "version": "20.9.3", "status": "affected" }, { "version": "20.11.1", "status": "affected" }, { "version": "20.6.3.2", "status": "affected" }, { "version": "20.4.2.3", "status": "affected" }, { "version": "20.3.5.1", "status": "affected" }, { "version": "20.3.4.3", "status": "affected" }, { "version": "20.9.3.1", "status": "affected" }, { "version": "20.6.4.1", "status": "affected" }, { "version": "20.3.3.2", "status": "affected" }, { "version": "20.6.5.2", "status": "affected" }, { "version": "20.3.7.1", "status": "affected" }, { "version": "20.11.1.1", "status": "affected" }, { "version": "20.10.1.1", "status": "affected" }, { "version": "20.6.1.2", "status": "affected" }, { "version": "20.1.3.1", "status": "affected" }, { "version": "20.9.2.2", "status": "affected" }, { "version": "20.6.5.3", "status": "affected" }, { "version": "20.6.3.3", "status": "affected" }, { "version": "20.3.7.2", "status": "affected" }, { "version": "20.6.5.4", "status": "affected" }, { "version": "20.9.2.3", "status": "affected" }, { "version": "20.9.4", "status": "affected" }, { "version": "20.12.1", "status": "affected" }, { "version": "20.3.8", "status": "affected" }, { "version": "20.6.6", "status": "affected" }, { "version": "20.12.2", "status": "affected" }, { "version": "20.13.1", "status": "affected" }, { "version": "20.9.5", "status": "affected" }, { "version": "20.12.3", "status": "affected" }, { "version": "20.6.7", "status": "affected" }, { "version": "20.9.5.1", "status": "affected" }, { "version": "20.14.1", "status": "affected" }, { "version": "20.12.3.1", "status": "affected" }, { "version": "20.12.4", "status": "affected" }, { "version": "20.15.1", "status": "affected" }, { "version": "20.9.6", "status": "affected" }, { "version": "20.6.8", "status": "affected" }, { "version": "20.16.1", "status": "affected" }, { "version": "20.9.5.3", "status": "affected" }, { "version": "20.12.4.1", "status": "affected" }, { "version": "20.15.2", "status": "affected" }, { "version": "20.12.5", "status": "affected" }, { "version": "20.9.7", "status": "affected" }, { "version": "20.15.3", "status": "affected" }, { "version": "20.12.5.1", "status": "affected" }, { "version": "20.12.5.2", "status": "affected" }, { "version": "20.15.4", "status": "affected" }, { "version": "20.9.7.1", "status": "affected" }, { "version": "20.12.6", "status": "affected" }, { "version": "20.9.8", "status": "affected" }, { "version": "20.15.4.1", "status": "affected" }, { "version": "20.15.4.2", "status": "affected" }, { "version": "20.12.5.3", "status": "affected" }, { "version": "20.12.6.1", "status": "affected" }, { "version": "20.9.8.2", "status": "affected" }, { "version": "20.15.5", "status": "affected" }, { "version": "20.12.7", "status": "affected" }, { "version": "20.9.9", "status": "affected" }, { "version": "20.15.5.1", "status": "affected" }, { "version": "20.15.4.3", "status": "affected" }, { "version": "20.15.4.5", "status": "affected" }, { "version": "20.15.5.3", "status": "affected" }, { "version": "20.12.7.2", "status": "affected" }, { "version": "20.9.9.2", "status": "affected" } ], "defaultStatus": "unknown" }, { "vendor": "Cisco", "product": "Cisco Catalyst SD-WAN Manager", "versions": [ { "version": "20.1.12", "status": "affected" }, { "version": "19.2.1", "status": "affected" }, { "version": "18.4.4", "status": "affected" }, { "version": "18.4.5", "status": "affected" }, { "version": "20.1.1.1", "status": "affected" }, { "version": "20.1.1", "status": "affected" }, { "version": "19.2.099", "status": "affected" }, { "version": "18.3.6", "status": "affected" }, { "version": "18.3.7", "status": "affected" }, { "version": "19.2.0", "status": "affected" }, { "version": "19.1.0", "status": "affected" }, { "version": "18.4.303", "status": "affected" }, { "version": "19.2.098", "status": "affected" }, { "version": "18.3.6.1", "status": "affected" }, { "version": "18.2.0", "status": "affected" }, { "version": "17.2.8", "status": "affected" }, { "version": "18.3.3.1", "status": "affected" }, { "version": "18.4.0", "status": "affected" }, { "version": "18.3.1", "status": "affected" }, { "version": "17.2.6", "status": "affected" }, { "version": "17.2.9", "status": "affected" }, { "version": "17.2.5", "status": "affected" }, { "version": "18.4.0.1", "status": "affected" }, { "version": "18.3.3", "status": "affected" }, { "version": "18.3.0", "status": "affected" }, { "version": "19.2.3", "status": "affected" }, { "version": "18.4.501_ES", "status": "affected" }, { "version": "20.1.2", "status": "affected" }, { "version": "19.2.929", "status": "affected" }, { "version": "19.2.31", "status": "affected" }, { "version": "20.3.2", "status": "affected" }, { "version": "19.2.4", "status": "affected" }, { "version": "19.2.4.0.9", "status": "affected" }, { "version": "20.1.3.1", "status": "affected" } ], "defaultStatus": "unknown" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-20182", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20182.json", "fetchedAt": "2026-10-23T02:43:47.354Z", "publishedAt": "2026-05-14T16:08:25.566Z", "modifiedAt": "2026-06-16T17:57:59.048Z", "state": "published", "provider": "cisco", "title": "Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability", "descriptions": [ { "lang": "en", "value": "May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection handshaking. The section of this advisory includes Show Control Connections guidance to help with system checks. \r\n\r\nA vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.\r\nThis vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to the affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Cisco", "product": "Cisco Catalyst SD-WAN Controller", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unknown", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "20.6.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "20.9.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "20.3.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "20.7.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "20.7.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/5", "version": "20.5.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/6", "version": "20.6.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/7", "version": "19.3.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/8", "version": "20.6.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/9", "version": "17.2.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/10", "version": "18.2.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/11", "version": "18.4.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/12", "version": "19.1.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/13", "version": "19.2.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/14", "version": "19.2.929", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/15", "version": "18.3.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/16", "version": "18.4.303", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/17", "version": "18.3.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/18", "version": "18.4.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/19", "version": "19.2.097", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/20", "version": "19.2.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/21", "version": "19.2.099", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/22", "version": "18.3.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/23", "version": "20.4.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/24", "version": "19.0.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/25", "version": "20.9.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/26", "version": "20.3.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/27", "version": "20.3.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/28", "version": "18.3.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/29", "version": "20.6.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/30", "version": "18.4.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/31", "version": "18.4.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/32", "version": "18.3.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/33", "version": "17.2.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/34", "version": "20.8.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/35", "version": "19.2.32", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/36", "version": "19.2.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/37", "version": "17.2.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/38", "version": "18.4.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/39", "version": "20.4.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/40", "version": "20.1.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/41", "version": "20.1.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/42", "version": "17.2.10", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/43", "version": "19.2.098", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/44", "version": "20.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/45", "version": "17.2.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/46", "version": "19.2.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/47", "version": "18.3.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/48", "version": "20.4.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/49", "version": "17.2.9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/50", "version": "19.2.31", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/51", "version": "19.0.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/52", "version": "18.3.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/53", "version": "17.2.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/54", "version": "18.4.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/55", "version": "20.3.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/56", "version": "20.3.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/57", "version": "20.4.1.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/58", "version": "20.3.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/59", "version": "18.3.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/60", "version": "20.1.12", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/61", "version": "19.2.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/62", "version": "20.10.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/63", "version": "20.6.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/64", "version": "20.3.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/65", "version": "20.9.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/66", "version": "20.11.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/67", "version": "20.6.3.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/68", "version": "20.4.2.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/69", "version": "20.3.5.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/70", "version": "20.3.4.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/71", "version": "20.9.3.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/72", "version": "20.6.4.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/73", "version": "20.3.3.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/74", "version": "20.6.5.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/75", "version": "20.3.7.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/76", "version": "20.11.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/77", "version": "20.10.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/78", "version": "20.6.1.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/79", "version": "20.1.3.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/80", "version": "20.9.2.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/81", "version": "20.6.5.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/82", "version": "20.6.3.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/83", "version": "20.3.7.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/84", "version": "20.6.5.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/85", "version": "20.9.2.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/86", "version": "20.9.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/87", "version": "20.12.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/88", "version": "20.3.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/89", "version": "20.6.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/90", "version": "20.12.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/91", "version": "20.13.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/92", "version": "20.9.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/93", "version": "20.12.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/94", "version": "20.6.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/95", "version": "20.9.5.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/96", "version": "20.14.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/97", "version": "20.12.3.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/98", "version": "20.12.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/99", "version": "20.15.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/100", "version": "20.9.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/101", "version": "20.6.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/102", "version": "20.16.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/103", "version": "20.9.5.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/104", "version": "20.12.4.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/105", "version": "20.15.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/106", "version": "20.12.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/107", "version": "20.9.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/108", "version": "20.15.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/109", "version": "20.12.5.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/110", "version": "20.12.5.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/111", "version": "20.15.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/112", "version": "20.9.7.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/113", "version": "20.12.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/114", "version": "20.9.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/115", "version": "20.15.4.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/116", "version": "20.15.4.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/117", "version": "20.12.5.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/118", "version": "20.12.6.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/119", "version": "20.9.8.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/120", "version": "20.15.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/121", "version": "20.12.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/122", "version": "20.9.9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/123", "version": "20.15.5.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/124", "version": "20.15.4.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/125", "version": "20.15.4.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/126", "version": "20.15.5.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/127", "version": "20.12.7.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/128", "version": "20.9.9.2", "status": "affected" } ] }, { "vendor": "Cisco", "product": "Cisco Catalyst SD-WAN Manager", "sourcePath": "/containers/cna/affected/1", "defaultStatus": "unknown", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "20.1.12", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/1", "version": "19.2.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/2", "version": "18.4.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/3", "version": "18.4.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/4", "version": "20.1.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/5", "version": "20.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/6", "version": "19.2.099", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/7", "version": "18.3.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/8", "version": "18.3.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/9", "version": "19.2.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/10", "version": "19.1.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/11", "version": "18.4.303", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/12", "version": "19.2.098", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/13", "version": "18.3.6.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/14", "version": "18.2.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/15", "version": "17.2.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/16", "version": "18.3.3.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/17", "version": "18.4.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/18", "version": "18.3.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/19", "version": "17.2.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/20", "version": "17.2.9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/21", "version": "17.2.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/22", "version": "18.4.0.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/23", "version": "18.3.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/24", "version": "18.3.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/25", "version": "19.2.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/26", "version": "18.4.501_ES", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/27", "version": "20.1.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/28", "version": "19.2.929", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/29", "version": "19.2.31", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/30", "version": "20.3.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/31", "version": "19.2.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/32", "version": "19.2.4.0.9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/33", "version": "20.1.3.1", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [ { "lang": "en", "value": "In May 2026, the Cisco Product Security Incident Response Team (PSIRT) became aware of limited exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.", "sourcePath": "/containers/cna/exploits/0/value" } ], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-287", "lang": "en", "description": "Improper Authentication", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 10, "baseSeverity": "CRITICAL", "provider": "cisco", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW", "label": "cisco-sa-sdwan-rpa2-v69WY2SW", "tags": [], "provider": "cisco", "sourcePath": "/containers/cna/references/0" }, { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk", "label": "Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection handshaking. The Indicators of Compromise", "tags": [], "provider": "cisco", "sourcePath": "/containers/cna/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20182", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20182.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Cisco\",\"product\":\"Cisco Catalyst SD-WAN Controller\",\"versions\":[{\"version\":\"20.6.4\",\"status\":\"affected\"},{\"version\":\"20.9.2\",\"status\":\"affected\"},{\"version\":\"20.3.6\",\"status\":\"affected\"},{\"version\":\"20.7.2\",\"status\":\"affected\"},{\"version\":\"20.7.1\",\"status\":\"affected\"},{\"version\":\"20.5.1\",\"status\":\"affected\"},{\"version\":\"20.6.2\",\"status\":\"affected\"},{\"version\":\"19.3.0\",\"status\":\"affected\"},{\"version\":\"20.6.1\",\"status\":\"affected\"},{\"version\":\"17.2.4\",\"status\":\"affected\"},{\"version\":\"18.2.0\",\"status\":\"affected\"},{\"version\":\"18.4.6\",\"status\":\"affected\"},{\"version\":\"19.1.0\",\"status\":\"affected\"},{\"version\":\"19.2.4\",\"status\":\"affected\"},{\"version\":\"19.2.929\",\"status\":\"affected\"},{\"version\":\"18.3.8\",\"status\":\"affected\"},{\"version\":\"18.4.303\",\"status\":\"affected\"},{\"version\":\"18.3.7\",\"status\":\"affected\"},{\"version\":\"18.4.1\",\"status\":\"affected\"},{\"version\":\"19.2.097\",\"status\":\"affected\"},{\"version\":\"19.2.0\",\"status\":\"affected\"},{\"version\":\"19.2.099\",\"status\":\"affected\"},{\"version\":\"18.3.6\",\"status\":\"affected\"},{\"version\":\"20.4.2\",\"status\":\"affected\"},{\"version\":\"19.0.0\",\"status\":\"affected\"},{\"version\":\"20.9.1\",\"status\":\"affected\"},{\"version\":\"20.3.5\",\"status\":\"affected\"},{\"version\":\"20.3.1\",\"status\":\"affected\"},{\"version\":\"18.3.5\",\"status\":\"affected\"},{\"version\":\"20.6.3\",\"status\":\"affected\"},{\"version\":\"18.4.3\",\"status\":\"affected\"},{\"version\":\"18.4.4\",\"status\":\"affected\"},{\"version\":\"18.3.3\",\"status\":\"affected\"},{\"version\":\"17.2.8\",\"status\":\"affected\"},{\"version\":\"20.8.1\",\"status\":\"affected\"},{\"version\":\"19.2.32\",\"status\":\"affected\"},{\"version\":\"19.2.2\",\"status\":\"affected\"},{\"version\":\"17.2.5\",\"status\":\"affected\"},{\"version\":\"18.4.0\",\"status\":\"affected\"},{\"version\":\"20.4.1.1\",\"status\":\"affected\"},{\"version\":\"20.1.3\",\"status\":\"affected\"},{\"version\":\"20.1.2\",\"status\":\"affected\"},{\"version\":\"17.2.10\",\"status\":\"affected\"},{\"version\":\"19.2.098\",\"status\":\"affected\"},{\"version\":\"20.1.1\",\"status\":\"affected\"},{\"version\":\"17.2.6\",\"status\":\"affected\"},{\"version\":\"19.2.1\",\"status\":\"affected\"},{\"version\":\"18.3.4\",\"status\":\"affected\"},{\"version\":\"20.4.1\",\"status\":\"affected\"},{\"version\":\"17.2.9\",\"status\":\"affected\"},{\"version\":\"19.2.31\",\"status\":\"affected\"},{\"version\":\"19.0.1a\",\"status\":\"affected\"},{\"version\":\"18.3.0\",\"status\":\"affected\"},{\"version\":\"17.2.7\",\"status\":\"affected\"},{\"version\":\"18.4.5\",\"status\":\"affected\"},{\"version\":\"20.3.4\",\"status\":\"affected\"},{\"version\":\"20.3.3\",\"status\":\"affected\"},{\"version\":\"20.4.1.2\",\"status\":\"affected\"},{\"version\":\"20.3.2\",\"status\":\"affected\"},{\"version\":\"18.3.1\",\"status\":\"affected\"},{\"version\":\"20.1.12\",\"status\":\"affected\"},{\"version\":\"19.2.3\",\"status\":\"affected\"},{\"version\":\"20.10.1\",\"status\":\"affected\"},{\"version\":\"20.6.5\",\"status\":\"affected\"},{\"version\":\"20.3.7\",\"status\":\"affected\"},{\"version\":\"20.9.3\",\"status\":\"affected\"},{\"version\":\"20.11.1\",\"status\":\"affected\"},{\"version\":\"20.6.3.2\",\"status\":\"affected\"},{\"version\":\"20.4.2.3\",\"status\":\"affected\"},{\"version\":\"20.3.5.1\",\"status\":\"affected\"},{\"version\":\"20.3.4.3\",\"status\":\"affected\"},{\"version\":\"20.9.3.1\",\"status\":\"affected\"},{\"version\":\"20.6.4.1\",\"status\":\"affected\"},{\"version\":\"20.3.3.2\",\"status\":\"affected\"},{\"version\":\"20.6.5.2\",\"status\":\"affected\"},{\"version\":\"20.3.7.1\",\"status\":\"affected\"},{\"version\":\"20.11.1.1\",\"status\":\"affected\"},{\"version\":\"20.10.1.1\",\"status\":\"affected\"},{\"version\":\"20.6.1.2\",\"status\":\"affected\"},{\"version\":\"20.1.3.1\",\"status\":\"affected\"},{\"version\":\"20.9.2.2\",\"status\":\"affected\"},{\"version\":\"20.6.5.3\",\"status\":\"affected\"},{\"version\":\"20.6.3.3\",\"status\":\"affected\"},{\"version\":\"20.3.7.2\",\"status\":\"affected\"},{\"version\":\"20.6.5.4\",\"status\":\"affected\"},{\"version\":\"20.9.2.3\",\"status\":\"affected\"},{\"version\":\"20.9.4\",\"status\":\"affected\"},{\"version\":\"20.12.1\",\"status\":\"affected\"},{\"version\":\"20.3.8\",\"status\":\"affected\"},{\"version\":\"20.6.6\",\"status\":\"affected\"},{\"version\":\"20.12.2\",\"status\":\"affected\"},{\"version\":\"20.13.1\",\"status\":\"affected\"},{\"version\":\"20.9.5\",\"status\":\"affected\"},{\"version\":\"20.12.3\",\"status\":\"affected\"},{\"version\":\"20.6.7\",\"status\":\"affected\"},{\"version\":\"20.9.5.1\",\"status\":\"affected\"},{\"version\":\"20.14.1\",\"status\":\"affected\"},{\"version\":\"20.12.3.1\",\"status\":\"affected\"},{\"version\":\"20.12.4\",\"status\":\"affected\"},{\"version\":\"20.15.1\",\"status\":\"affected\"},{\"version\":\"20.9.6\",\"status\":\"affected\"},{\"version\":\"20.6.8\",\"status\":\"affected\"},{\"version\":\"20.16.1\",\"status\":\"affected\"},{\"version\":\"20.9.5.3\",\"status\":\"affected\"},{\"version\":\"20.12.4.1\",\"status\":\"affected\"},{\"version\":\"20.15.2\",\"status\":\"affected\"},{\"version\":\"20.12.5\",\"status\":\"affected\"},{\"version\":\"20.9.7\",\"status\":\"affected\"},{\"version\":\"20.15.3\",\"status\":\"affected\"},{\"version\":\"20.12.5.1\",\"status\":\"affected\"},{\"version\":\"20.12.5.2\",\"status\":\"affected\"},{\"version\":\"20.15.4\",\"status\":\"affected\"},{\"version\":\"20.9.7.1\",\"status\":\"affected\"},{\"version\":\"20.12.6\",\"status\":\"affected\"},{\"version\":\"20.9.8\",\"status\":\"affected\"},{\"version\":\"20.15.4.1\",\"status\":\"affected\"},{\"version\":\"20.15.4.2\",\"status\":\"affected\"},{\"version\":\"20.12.5.3\",\"status\":\"affected\"},{\"version\":\"20.12.6.1\",\"status\":\"affected\"},{\"version\":\"20.9.8.2\",\"status\":\"affected\"},{\"version\":\"20.15.5\",\"status\":\"affected\"},{\"version\":\"20.12.7\",\"status\":\"affected\"},{\"version\":\"20.9.9\",\"status\":\"affected\"},{\"version\":\"20.15.5.1\",\"status\":\"affected\"},{\"version\":\"20.15.4.3\",\"status\":\"affected\"},{\"version\":\"20.15.4.5\",\"status\":\"affected\"},{\"version\":\"20.15.5.3\",\"status\":\"affected\"},{\"version\":\"20.12.7.2\",\"status\":\"affected\"},{\"version\":\"20.9.9.2\",\"status\":\"affected\"}],\"defaultStatus\":\"unknown\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20182.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Cisco\",\"product\":\"Cisco Catalyst SD-WAN Manager\",\"versions\":[{\"version\":\"20.1.12\",\"status\":\"affected\"},{\"version\":\"19.2.1\",\"status\":\"affected\"},{\"version\":\"18.4.4\",\"status\":\"affected\"},{\"version\":\"18.4.5\",\"status\":\"affected\"},{\"version\":\"20.1.1.1\",\"status\":\"affected\"},{\"version\":\"20.1.1\",\"status\":\"affected\"},{\"version\":\"19.2.099\",\"status\":\"affected\"},{\"version\":\"18.3.6\",\"status\":\"affected\"},{\"version\":\"18.3.7\",\"status\":\"affected\"},{\"version\":\"19.2.0\",\"status\":\"affected\"},{\"version\":\"19.1.0\",\"status\":\"affected\"},{\"version\":\"18.4.303\",\"status\":\"affected\"},{\"version\":\"19.2.098\",\"status\":\"affected\"},{\"version\":\"18.3.6.1\",\"status\":\"affected\"},{\"version\":\"18.2.0\",\"status\":\"affected\"},{\"version\":\"17.2.8\",\"status\":\"affected\"},{\"version\":\"18.3.3.1\",\"status\":\"affected\"},{\"version\":\"18.4.0\",\"status\":\"affected\"},{\"version\":\"18.3.1\",\"status\":\"affected\"},{\"version\":\"17.2.6\",\"status\":\"affected\"},{\"version\":\"17.2.9\",\"status\":\"affected\"},{\"version\":\"17.2.5\",\"status\":\"affected\"},{\"version\":\"18.4.0.1\",\"status\":\"affected\"},{\"version\":\"18.3.3\",\"status\":\"affected\"},{\"version\":\"18.3.0\",\"status\":\"affected\"},{\"version\":\"19.2.3\",\"status\":\"affected\"},{\"version\":\"18.4.501_ES\",\"status\":\"affected\"},{\"version\":\"20.1.2\",\"status\":\"affected\"},{\"version\":\"19.2.929\",\"status\":\"affected\"},{\"version\":\"19.2.31\",\"status\":\"affected\"},{\"version\":\"20.3.2\",\"status\":\"affected\"},{\"version\":\"19.2.4\",\"status\":\"affected\"},{\"version\":\"19.2.4.0.9\",\"status\":\"affected\"},{\"version\":\"20.1.3.1\",\"status\":\"affected\"}],\"defaultStatus\":\"unknown\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20182.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection handshaking. The section of this advisory includes Show Control Connections guidance to help with system checks. \r\n\r\nA vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.\r\nThis vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to the affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/exploits/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20182.json", "sourcePath": "/containers/cna/exploits/0/value", "text": "In May 2026, the Cisco Product Security Incident Response Team (PSIRT) became aware of limited exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20182.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"Improper Authentication\",\"type\":\"cwe\",\"cweId\":\"CWE-287\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20182.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":10,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-06-16T17:57:59.048Z", "fetchedAt": "2026-10-23T02:43:47.354Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-05-14T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlined in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.", "sourceSummary": "Cisco Catalyst SD-WAN Controller / Cisco Catalyst SD-WAN Managerに認証の回避に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "ログインなどの認証を回避され、不正な操作につながる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:23:43.614Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "ca4fa15b79c404327731b2a9b33a1f3aa636067f5c55c6bf70882f47b7cc78db", "sourceModifiedAt": "2026-06-16T17:57:59.048Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Cisco Catalyst SD-WAN Controller（旧 SD‑WAN vSmart）・Cisco Catalyst SD‑WAN Manager（旧 SD‑WAN vManage）・Cisco Catalyst SD‑WAN Validator（旧 SD‑WAN vBond）のピア認証に不備があり、認証が正しく機能しません。この欠陥を利用して、認証されていないリモート攻撃者が細工したリクエストを送信すると、内部の高権限（ただし root ではない）ユーザーとしてログインでき、NETCONF にアクセスして SD‑WAN ファブリックのネットワーク設定を操作できる可能性があります。", "risk": "攻撃者が認証を回避して管理者権限を取得し、NETCONF を通じて SD‑WAN のネットワーク構成を不正に変更できる恐れがあります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Cisco Catalyst SD‑WAN Controller のすべての影響対象バージョンは、ソース S4 に列挙されたバージョンです。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20182.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "Cisco Catalyst SD‑WAN Manager のすべての影響対象バージョンは、ソース S5 に列挙されたバージョンです。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20182.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "公式の対象表：Cisco / Cisco Catalyst SD-WAN Controller。影響ありとして記載：20.6.4。影響ありとして記載：20.9.2。影響ありとして記載：20.3.6。影響ありとして記載：20.7.2。影響ありとして記載：20.7.1。影響ありとして記載：20.5.1。影響ありとして記載：20.6.2。影響ありとして記載：19.3.0。影響ありとして記載：20.6.1。影響ありとして記載：17.2.4。影響ありとして記載：18.2.0。影響ありとして記載：18.4.6。影響ありとして記載：19.1.0。影響ありとして記載：19.2.4。影響ありとして記載：19.2.929。影響ありとして記載：18.3.8。影響ありとして記載：18.4.303。影響ありとして記載：18.3.7。影響ありとして記載：18.4.1。影響ありとして記載：19.2.097。影響ありとして記載：19.2.0。影響ありとして記載：19.2.099。影響ありとして記載：18.3.6。影響ありとして記載：20.4.2。影響ありとして記載：19.0.0。影響ありとして記載：20.9.1。影響ありとして記載：20.3.5。影響ありとして記載：20.3.1。影響ありとして記載：18.3.5。影響ありとして記載：20.6.3。影響ありとして記載：18.4.3。影響ありとして記載：18.4.4。影響ありとして記載：18.3.3。影響ありとして記載：17.2.8。影響ありとして記載：20.8.1。影響ありとして記載：19.2.32。影響ありとして記載：19.2.2。影響ありとして記載：17.2.5。影響ありとして記載：18.4.0。影響ありとして記載：20.4.1.1。影響ありとして記載：20.1.3。影響ありとして記載：20.1.2。影響ありとして記載：17.2.10。影響ありとして記載：19.2.098。影響ありとして記載：20.1.1。影響ありとして記載：17.2.6。影響ありとして記載：19.2.1。影響ありとして記載：18.3.4。影響ありとして記載：20.4.1。影響ありとして記載：17.2.9。影響ありとして記載：19.2.31。影響ありとして記載：19.0.1a。影響ありとして記載：18.3.0。影響ありとして記載：17.2.7。影響ありとして記載：18.4.5。影響ありとして記載：20.3.4。影響ありとして記載：20.3.3。影響ありとして記載：20.4.1.2。影響ありとして記載：20.3.2。影響ありとして記載：18.3.1。影響ありとして記載：20.1.12。影響ありとして記載：19.2.3。影響ありとして記載：20.10.1。影響ありとして記載：20.6.5。影響ありとして記載：20.3.7。影響ありとして記載：20.9.3。影響ありとして記載：20.11.1。影響ありとして記載：20.6.3.2。影響ありとして記載：20.4.2.3。影響ありとして記載：20.3.5.1。影響ありとして記載：20.3.4.3。影響ありとして記載：20.9.3.1。影響ありとして記載：20.6.4.1。影響ありとして記載：20.3.3.2。影響ありとして記載：20.6.5.2。影響ありとして記載：20.3.7.1。影響ありとして記載：20.11.1.1。影響ありとして記載：20.10.1.1。影響ありとして記載：20.6.1.2。影響ありとして記載：20.1.3.1。影響ありとして記載：20.9.2.2。影響ありとして記載：20.6.5.3。影響ありとして記載：20.6.3.3。影響ありとして記載：20.3.7.2。影響ありとして記載：20.6.5.4。影響ありとして記載：20.9.2.3。影響ありとして記載：20.9.4。影響ありとして記載：20.12.1。影響ありとして記載：20.3.8。影響ありとして記載：20.6.6。影響ありとして記載：20.12.2。影響ありとして記載：20.13.1。影響ありとして記載：20.9.5。影響ありとして記載：20.12.3。影響ありとして記載：20.6.7。影響ありとして記載：20.9.5.1。影響ありとして記載：20.14.1。影響ありとして記載：20.12.3.1。影響ありとして記載：20.12.4。影響ありとして記載：20.15.1。影響ありとして記載：20.9.6。影響ありとして記載：20.6.8。影響ありとして記載：20.16.1。影響ありとして記載：20.9.5.3。影響ありとして記載：20.12.4.1。影響ありとして記載：20.15.2。影響ありとして記載：20.12.5。影響ありとして記載：20.9.7。影響ありとして記載：20.15.3。影響ありとして記載：20.12.5.1。影響ありとして記載：20.12.5.2。影響ありとして記載：20.15.4。影響ありとして記載：20.9.7.1。影響ありとして記載：20.12.6。影響ありとして記載：20.9.8。影響ありとして記載：20.15.4.1。影響ありとして記載：20.15.4.2。影響ありとして記載：20.12.5.3。影響ありとして記載：20.12.6.1。影響ありとして記載：20.9.8.2。影響ありとして記載：20.15.5。影響ありとして記載：20.12.7。影響ありとして記載：20.9.9。影響ありとして記載：20.15.5.1。影響ありとして記載：20.15.4.3。影響ありとして記載：20.15.4.5。影響ありとして記載：20.15.5.3。影響ありとして記載：20.12.7.2。影響ありとして記載：20.9.9.2。個別に記されていない版の影響は、原資料でも未確定です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20182.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Cisco / Cisco Catalyst SD-WAN Manager。影響ありとして記載：20.1.12。影響ありとして記載：19.2.1。影響ありとして記載：18.4.4。影響ありとして記載：18.4.5。影響ありとして記載：20.1.1.1。影響ありとして記載：20.1.1。影響ありとして記載：19.2.099。影響ありとして記載：18.3.6。影響ありとして記載：18.3.7。影響ありとして記載：19.2.0。影響ありとして記載：19.1.0。影響ありとして記載：18.4.303。影響ありとして記載：19.2.098。影響ありとして記載：18.3.6.1。影響ありとして記載：18.2.0。影響ありとして記載：17.2.8。影響ありとして記載：18.3.3.1。影響ありとして記載：18.4.0。影響ありとして記載：18.3.1。影響ありとして記載：17.2.6。影響ありとして記載：17.2.9。影響ありとして記載：17.2.5。影響ありとして記載：18.4.0.1。影響ありとして記載：18.3.3。影響ありとして記載：18.3.0。影響ありとして記載：19.2.3。影響ありとして記載：18.4.501_ES。影響ありとして記載：20.1.2。影響ありとして記載：19.2.929。影響ありとして記載：19.2.31。影響ありとして記載：20.3.2。影響ありとして記載：19.2.4。影響ありとして記載：19.2.4.0.9。影響ありとして記載：20.1.3.1。個別に記されていない版の影響は、原資料でも未確定です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20182.json" ], "evidenceIds": [ "E4" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20182" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20182.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Cisco Catalyst SD-WAN Controller / Cisco Catalyst SD-WAN Manager」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-20182", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20182", "https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems", "https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems", "https://nvd.nist.gov/vuln/detail/CVE-2026-20182" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20182.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-20182", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20182", "https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems", "https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems", "https://nvd.nist.gov/vuln/detail/CVE-2026-20182" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20182.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-20182", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20182", "https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems", "https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems", "https://nvd.nist.gov/vuln/detail/CVE-2026-20182" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20182.json", "label": "CVE：cisco" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20182", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-20182", "label": "CVE公式レコード" }, { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW", "label": "CISAが示す関連情報" }, { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk", "label": "Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability was disclosed in February 2026. This new adviso" }, { "url": "https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20182", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20182.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection handshaking. The section of this advisory includes Show Control Connections guidance to help with system checks. \r\n\r\nA vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.\r\nThis vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to the affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20182.json", "sourceField": "/containers/cna/title", "excerpt": "Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20182.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Cisco\",\"product\":\"Cisco Catalyst SD-WAN Controller\",\"versions\":[{\"version\":\"20.6.4\",\"status\":\"affected\"},{\"version\":\"20.9.2\",\"status\":\"affected\"},{\"version\":\"20.3.6\",\"status\":\"affected\"},{\"version\":\"20.7.2\",\"status\":\"affected\"},{\"version\":\"20.7.1\",\"status\":\"affected\"},{\"version\":\"20.5.1\",\"status\":\"affected\"},{\"version\":\"20.6.2\",\"status\":\"affected\"},{\"version\":\"19.3.0\",\"status\":\"affected\"},{\"version\":\"20.6.1\",\"status\":\"affected\"},{\"version\":\"17.2.4\",\"status\":\"affected\"},{\"version\":\"18.2.0\",\"status\":\"affected\"},{\"version\":\"18.4.6\",\"status\":\"affected\"},{\"version\":\"19.1.0\",\"status\":\"affected\"},{\"version\":\"19.2.4\",\"status\":\"affected\"},{\"version\":\"19.2.929\",\"status\":\"affected\"},{\"version\":\"18.3.8\",\"status\":\"affected\"},{\"version\":\"18.4.303\",\"status\":\"affected\"},{\"version\":\"18.3.7\",\"status\":\"affected\"},{\"version\":\"18.4.1\",\"status\":\"affected\"},{\"version\":\"19.2.097\",\"status\":\"affected\"},{\"version\":\"19.2.0\",\"status\":\"affected\"},{\"version\":\"19.2.099\",\"status\":\"affected\"},{\"version\":\"18.3.6\",\"status\":\"affected\"},{\"version\":\"20.4.2\",\"status\":\"affected\"},{\"version\":\"19.0.0\",\"status\":\"affected\"},{\"version\":\"20.9.1\",\"status\":\"affected\"},{\"version\":\"20.3.5\",\"status\":\"affected\"},{\"version\":\"20.3.1\",\"status\":\"affected\"},{\"version\":\"18.3.5\",\"status\":\"affected\"},{\"version\":\"20.6.3\",\"status\":\"affected\"},{\"version\":\"18.4.3\",\"status\":\"affected\"},{\"version\":\"18.4.4\",\"status\":\"affected\"},{\"version\":\"18.3.3\",\"status\":\"affected\"},{\"version\":\"17.2.8\",\"status\":\"affected\"},{\"version\":\"20.8.1\",\"status\":\"affected\"},{\"version\":\"19.2.32\",\"status\":\"affected\"},{\"version\":\"19.2.2\",\"status\":\"affected\"},{\"version\":\"17.2.5\",\"status\":\"affected\"},{\"version\":\"18.4.0\",\"status\":\"affected\"},{\"version\":\"20.4.1.1\",\"status\":\"affected\"},{\"version\":\"20.1.3\",\"status\":\"affected\"},{\"version\":\"20.1.2\",\"status\":\"affected\"},{\"version\":\"17.2.10\",\"status\":\"affected\"},{\"version\":\"19.2.098\",\"status\":\"affected\"},{\"version\":\"20.1.1\",\"status\":\"affected\"},{\"version\":\"17.2.6\",\"status\":\"affected\"},{\"version\":\"19.2.1\",\"status\":\"affected\"},{\"version\":\"18.3.4\",\"status\":\"affected\"},{\"version\":\"20.4.1\",\"status\":\"affected\"},{\"version\":\"17.2.9\",\"status\":\"affected\"},{\"version\":\"19.2.31\",\"status\":\"affected\"},{\"version\":\"19.0.1a\",\"status\":\"affected\"},{\"version\":\"18.3.0\",\"status\":\"affected\"},{\"version\":\"17.2.7\",\"status\":\"affected\"},{\"version\":\"18.4.5\",\"status\":\"affected\"},{\"version\":\"20.3.4\",\"status\":\"affected\"},{\"version\":\"20.3.3\",\"status\":\"affected\"},{\"version\":\"20.4.1.2\",\"status\":\"affected\"},{\"version\":\"20.3.2\",\"status\":\"affected\"},{\"version\":\"18.3.1\",\"status\":\"affected\"},{\"version\":\"20.1.12\",\"status\":\"affected\"},{\"version\":\"19.2.3\",\"status\":\"affected\"},{\"version\":\"20.10.1\",\"status\":\"affected\"},{\"version\":\"20.6.5\",\"status\":\"affected\"},{\"version\":\"20.3.7\",\"status\":\"affected\"},{\"version\":\"20.9.3\",\"status\":\"affected\"},{\"version\":\"20.11.1\",\"status\":\"affected\"},{\"version\":\"20.6.3.2\",\"status\":\"affected\"},{\"version\":\"20.4.2.3\",\"status\":\"affected\"},{\"version\":\"20.3.5.1\",\"status\":\"affected\"},{\"version\":\"20.3.4.3\",\"status\":\"affected\"},{\"version\":\"20.9.3.1\",\"status\":\"affected\"},{\"version\":\"20.6.4.1\",\"status\":\"affected\"},{\"version\":\"20.3.3.2\",\"status\":\"affected\"},{\"version\":\"20.6.5.2\",\"status\":\"affected\"},{\"version\":\"20.3.7.1\",\"status\":\"affected\"},{\"version\":\"20.11.1.1\",\"status\":\"affected\"},{\"version\":\"20.10.1.1\",\"status\":\"affected\"},{\"version\":\"20.6.1.2\",\"status\":\"affected\"},{\"version\":\"20.1.3.1\",\"status\":\"affected\"},{\"version\":\"20.9.2.2\",\"status\":\"affected\"},{\"version\":\"20.6.5.3\",\"status\":\"affected\"},{\"version\":\"20.6.3.3\",\"status\":\"affected\"},{\"version\":\"20.3.7.2\",\"status\":\"affected\"},{\"version\":\"20.6.5.4\",\"status\":\"affected\"},{\"version\":\"20.9.2.3\",\"status\":\"affected\"},{\"version\":\"20.9.4\",\"status\":\"affected\"},{\"version\":\"20.12.1\",\"status\":\"affected\"},{\"version\":\"20.3.8\",\"status\":\"affected\"},{\"version\":\"20.6.6\",\"status\":\"affected\"},{\"version\":\"20.12.2\",\"status\":\"affected\"},{\"version\":\"20.13.1\",\"status\":\"affected\"},{\"version\":\"20.9.5\",\"status\":\"affected\"},{\"version\":\"20.12.3\",\"status\":\"affected\"},{\"version\":\"20.6.7\",\"status\":\"affected\"},{\"version\":\"20.9.5.1\",\"status\":\"affected\"},{\"version\":\"20.14.1\",\"status\":\"affected\"},{\"version\":\"20.12.3.1\",\"status\":\"affected\"},{\"version\":\"20.12.4\",\"status\":\"affected\"},{\"version\":\"20.15.1\",\"status\":\"affected\"},{\"version\":\"20.9.6\",\"status\":\"affected\"},{\"version\":\"20.6.8\",\"status\":\"affected\"},{\"version\":\"20.16.1\",\"status\":\"affected\"},{\"version\":\"20.9.5.3\",\"status\":\"affected\"},{\"version\":\"20.12.4.1\",\"status\":\"affected\"},{\"version\":\"20.15.2\",\"status\":\"affected\"},{\"version\":\"20.12.5\",\"status\":\"affected\"},{\"version\":\"20.9.7\",\"status\":\"affected\"},{\"version\":\"20.15.3\",\"status\":\"affected\"},{\"version\":\"20.12.5.1\",\"status\":\"affected\"},{\"version\":\"20.12.5.2\",\"status\":\"affected\"},{\"version\":\"20.15.4\",\"status\":\"affected\"},{\"version\":\"20.9.7.1\",\"status\":\"affected\"},{\"version\":\"20.12.6\",\"status\":\"affected\"},{\"version\":\"20.9.8\",\"status\":\"affected\"},{\"version\":\"20.15.4.1\",\"status\":\"affected\"},{\"version\":\"20.15.4.2\",\"status\":\"affected\"},{\"version\":\"20.12.5.3\",\"status\":\"affected\"},{\"version\":\"20.12.6.1\",\"status\":\"affected\"},{\"version\":\"20.9.8.2\",\"status\":\"affected\"},{\"version\":\"20.15.5\",\"status\":\"affected\"},{\"version\":\"20.12.7\",\"status\":\"affected\"},{\"version\":\"20.9.9\",\"status\":\"affected\"},{\"version\":\"20.15.5.1\",\"status\":\"affected\"},{\"version\":\"20.15.4.3\",\"status\":\"affected\"},{\"version\":\"20.15.4.5\",\"status\":\"affected\"},{\"version\":\"20.15.5.3\",\"status\":\"affected\"},{\"version\":\"20.12.7.2\",\"status\":\"affected\"},{\"version\":\"20.9.9.2\",\"status\":\"affected\"}],\"defaultStatus\":\"unknown\"}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20182.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Cisco\",\"product\":\"Cisco Catalyst SD-WAN Manager\",\"versions\":[{\"version\":\"20.1.12\",\"status\":\"affected\"},{\"version\":\"19.2.1\",\"status\":\"affected\"},{\"version\":\"18.4.4\",\"status\":\"affected\"},{\"version\":\"18.4.5\",\"status\":\"affected\"},{\"version\":\"20.1.1.1\",\"status\":\"affected\"},{\"version\":\"20.1.1\",\"status\":\"affected\"},{\"version\":\"19.2.099\",\"status\":\"affected\"},{\"version\":\"18.3.6\",\"status\":\"affected\"},{\"version\":\"18.3.7\",\"status\":\"affected\"},{\"version\":\"19.2.0\",\"status\":\"affected\"},{\"version\":\"19.1.0\",\"status\":\"affected\"},{\"version\":\"18.4.303\",\"status\":\"affected\"},{\"version\":\"19.2.098\",\"status\":\"affected\"},{\"version\":\"18.3.6.1\",\"status\":\"affected\"},{\"version\":\"18.2.0\",\"status\":\"affected\"},{\"version\":\"17.2.8\",\"status\":\"affected\"},{\"version\":\"18.3.3.1\",\"status\":\"affected\"},{\"version\":\"18.4.0\",\"status\":\"affected\"},{\"version\":\"18.3.1\",\"status\":\"affected\"},{\"version\":\"17.2.6\",\"status\":\"affected\"},{\"version\":\"17.2.9\",\"status\":\"affected\"},{\"version\":\"17.2.5\",\"status\":\"affected\"},{\"version\":\"18.4.0.1\",\"status\":\"affected\"},{\"version\":\"18.3.3\",\"status\":\"affected\"},{\"version\":\"18.3.0\",\"status\":\"affected\"},{\"version\":\"19.2.3\",\"status\":\"affected\"},{\"version\":\"18.4.501_ES\",\"status\":\"affected\"},{\"version\":\"20.1.2\",\"status\":\"affected\"},{\"version\":\"19.2.929\",\"status\":\"affected\"},{\"version\":\"19.2.31\",\"status\":\"affected\"},{\"version\":\"20.3.2\",\"status\":\"affected\"},{\"version\":\"19.2.4\",\"status\":\"affected\"},{\"version\":\"19.2.4.0.9\",\"status\":\"affected\"},{\"version\":\"20.1.3.1\",\"status\":\"affected\"}],\"defaultStatus\":\"unknown\"}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20182", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-20182\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-20182（Cisco Catalyst SD-WAN Controller / Cisco Catalyst SD-WAN Manager）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Cisco Catalyst SD‑WAN Controller のすべての影響対象バージョンは、ソース S4 に列挙されたバージョンです。\n・Cisco Catalyst SD‑WAN Manager のすべての影響対象バージョンは、ソース S5 に列挙されたバージョンです。\n・公式の対象表：Cisco / Cisco Catalyst SD-WAN Controller。影響ありとして記載：20.6.4。影響ありとして記載：20.9.2。影響ありとして記載：20.3.6。影響ありとして記載：20.7.2。影響ありとして記載：20.7.1。影響ありとして記載：20.5.1。影響ありとして記載：20.6.2。影響ありとして記載：19.3.0。影響ありとして記載：20.6.1。影響ありとして記載：17.2.4。影響ありとして記載：18.2.0。影響ありとして記載：18.4.6。影響ありとして記載：19.1.0。影響ありとして記載：19.2.4。影響ありとして記載：19.2.929。影響ありとして記載：18.3.8。影響ありとして記載：18.4.303。影響ありとして記載：18.3.7。影響ありとして記載：18.4.1。影響ありとして記載：19.2.097。影響ありとして記載：19.2.0。影響ありとして記載：19.2.099。影響ありとして記載：18.3.6。影響ありとして記載：20.4.2。影響ありとして記載：19.0.0。影響ありとして記載：20.9.1。影響ありとして記載：20.3.5。影響ありとして記載：20.3.1。影響ありとして記載：18.3.5。影響ありとして記載：20.6.3。影響ありとして記載：18.4.3。影響ありとして記載：18.4.4。影響ありとして記載：18.3.3。影響ありとして記載：17.2.8。影響ありとして記載：20.8.1。影響ありとして記載：19.2.32。影響ありとして記載：19.2.2。影響ありとして記載：17.2.5。影響ありとして記載：18.4.0。影響ありとして記載：20.4.1.1。影響ありとして記載：20.1.3。影響ありとして記載：20.1.2。影響ありとして記載：17.2.10。影響ありとして記載：19.2.098。影響ありとして記載：20.1.1。影響ありとして記載：17.2.6。影響ありとして記載：19.2.1。影響ありとして記載：18.3.4。影響ありとして記載：20.4.1。影響ありとして記載：17.2.9。影響ありとして記載：19.2.31。影響ありとして記載：19.0.1a。影響ありとして記載：18.3.0。影響ありとして記載：17.2.7。影響ありとして記載：18.4.5。影響ありとして記載：20.3.4。影響ありとして記載：20.3.3。影響ありとして記載：20.4.1.2。影響ありとして記載：20.3.2。影響ありとして記載：18.3.1。影響ありとして記載：20.1.12。影響ありとして記載：19.2.3。影響ありとして記載：20.10.1。影響ありとして記載：20.6.5。影響ありとして記載：20.3.7。影響ありとして記載：20.9.3。影響ありとして記載：20.11.1。影響ありとして記載：20.6.3.2。影響ありとして記載：20.4.2.3。影響ありとして記載：20.3.5.1。影響ありとして記載：20.3.4.3。影響ありとして記載：20.9.3.1。影響ありとして記載：20.6.4.1。影響ありとして記載：20.3.3.2。影響ありとして記載：20.6.5.2。影響ありとして記載：20.3.7.1。影響ありとして記載：20.11.1.1。影響ありとして記載：20.10.1.1。影響ありとして記載：20.6.1.2。影響ありとして記載：20.1.3.1。影響ありとして記載：20.9.2.2。影響ありとして記載：20.6.5.3。影響ありとして記載：20.6.3.3。影響ありとして記載：20.3.7.2。影響ありとして記載：20.6.5.4。影響ありとして記載：20.9.2.3。影響ありとして記載：20.9.4。影響ありとして記載：20.12.1。影響ありとして記載：20.3.8。影響ありとして記載：20.6.6。影響ありとして記載：20.12.2。影響ありとして記載：20.13.1。影響ありとして記載：20.9.5。影響ありとして記載：20.12.3。影響ありとして記載：20.6.7。影響ありとして記載：20.9.5.1。影響ありとして記載：20.14.1。影響ありとして記載：20.12.3.1。影響ありとして記載：20.12.4。影響ありとして記載：20.15.1。影響ありとして記載：20.9.6。影響ありとして記載：20.6.8。影響ありとして記載：20.16.1。影響ありとして記載：20.9.5.3。影響ありとして記載：20.12.4.1。影響ありとして記載：20.15.2。影響ありとして記載：20.12.5。影響ありとして記載：20.9.7。影響ありとして記載：20.15.3。影響ありとして記載：20.12.5.1。影響ありとして記載：20.12.5.2。影響ありとして記載：20.15.4。影響ありとして記載：20.9.7.1。影響ありとして記載：20.12.6。影響ありとして記載：20.9.8。影響ありとして記載：20.15.4.1。影響ありとして記載：20.15.4.2。影響ありとして記載：20.12.5.3。影響ありとして記載：20.12.6.1。影響ありとして記載：20.9.8.2。影響ありとして記載：20.15.5。影響ありとして記載：20.12.7。影響ありとして記載：20.9.9。影響ありとして記載：20.15.5.1。影響ありとして記載：20.15.4.3。影響ありとして記載：20.15.4.5。影響ありとして記載：20.15.5.3。影響ありとして記載：20.12.7.2。影響ありとして記載：20.9.9.2。個別に記されていない版の影響は、原資料でも未確定です。\n・公式の対象表：Cisco / Cisco Catalyst SD-WAN Manager。影響ありとして記載：20.1.12。影響ありとして記載：19.2.1。影響ありとして記載：18.4.4。影響ありとして記載：18.4.5。影響ありとして記載：20.1.1.1。影響ありとして記載：20.1.1。影響ありとして記載：19.2.099。影響ありとして記載：18.3.6。影響ありとして記載：18.3.7。影響ありとして記載：19.2.0。影響ありとして記載：19.1.0。影響ありとして記載：18.4.303。影響ありとして記載：19.2.098。影響ありとして記載：18.3.6.1。影響ありとして記載：18.2.0。影響ありとして記載：17.2.8。影響ありとして記載：18.3.3.1。影響ありとして記載：18.4.0。影響ありとして記載：18.3.1。影響ありとして記載：17.2.6。影響ありとして記載：17.2.9。影響ありとして記載：17.2.5。影響ありとして記載：18.4.0.1。影響ありとして記載：18.3.3。影響ありとして記載：18.3.0。影響ありとして記載：19.2.3。影響ありとして記載：18.4.501_ES。影響ありとして記載：20.1.2。影響ありとして記載：19.2.929。影響ありとして記載：19.2.31。影響ありとして記載：20.3.2。影響ありとして記載：19.2.4。影響ありとして記載：19.2.4.0.9。影響ありとして記載：20.1.3.1。個別に記されていない版の影響は、原資料でも未確定です。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-20182", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:23:43.614Z", "lastSuccess": "2026-10-23T03:23:43.614Z", "sourceCheckedAt": "2026-10-23T02:43:47.354Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-42208", "aliases": [], "title": "litellm：データベースへの不正操作", "summary": "LiteLLMはAIゲートウェイとしてLLM APIを呼び出すプロキシサーバーです。バージョン1.81.16から1.83.7未満までの間、プロキシのAPIキー検証で呼び出し側が提供したキーをSQLクエリ文字列に直接埋め込んでおり、認証されていない攻撃者が細工したAuthorizationヘッダーを任意のLLM APIルート（例：POST /chat/completions）に送ると、プロキシのエラーハンドリング経路を通ってこのクエリが実行されます。その結果、攻撃者はデータベースのデータを読み取れ、場合によっては書き換えることができ、プロキシや管理している認証情報への不正アクセスにつながります。この問題はバージョン1.83.7で修正されています。", "risk": "攻撃者がデータベースのデータを読み取れ、書き換えることができるため、プロキシへの不正アクセスや管理認証情報の漏洩が起こる可能性があります。", "product": "litellm", "category": "other", "component": "package", "severity": "critical", "cvss": 9.3, "cvssVersion": "4.0", "cvssSource": "GitHub_M", "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "affected": [ { "product": "litellm", "range": ">= 1.81.16, < 1.83.7" } ], "fixed": [], "steps": [ "バージョン1.83.7にアップグレードする。", "「CVE-2026-42208」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42208.json", "label": "CVE：GitHub_M" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-42208", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-42208", "label": "CVE公式レコード" }, { "url": "https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc", "label": "CISAが示す関連情報" }, { "url": "https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable", "label": "https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42208", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-05-08T03:38:14.124Z", "modifiedAt": "2026-07-15T00:58:03.861Z", "fetchedAt": "2026-10-23T02:43:48.921Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before version 1.83.7, a database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. An unauthenticated attacker could send a specially crafted Authorization header to any LLM API route (for example POST /chat/completions) and reach this query through the proxy's error-handling path. An attacker could read data from the proxy's database and may be able to modify it, leading to unauthorised access to the proxy and the credentials it manages. This issue has been patched in version 1.83.7.", "sourceTitle": "LiteLLM: SQL injection in Proxy API key verification", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "BerriAI", "product": "litellm", "versions": [ { "version": ">= 1.81.16, < 1.83.7", "status": "affected" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-42208", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42208.json", "fetchedAt": "2026-10-23T02:43:48.921Z", "publishedAt": "2026-05-08T03:38:14.124Z", "modifiedAt": "2026-07-15T00:58:03.861Z", "state": "published", "provider": "GitHub_M", "title": "LiteLLM: SQL injection in Proxy API key verification", "descriptions": [ { "lang": "en", "value": "LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before version 1.83.7, a database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. An unauthenticated attacker could send a specially crafted Authorization header to any LLM API route (for example POST /chat/completions) and reach this query through the proxy's error-handling path. An attacker could read data from the proxy's database and may be able to modify it, leading to unauthorised access to the proxy and the credentials it manages. This issue has been patched in version 1.83.7.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "BerriAI", "product": "litellm", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": ">= 1.81.16, < 1.83.7", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-89", "lang": "en", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "baseScore": 9.3, "baseSeverity": "CRITICAL", "provider": "GitHub_M", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" }, { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/metrics/1/cvssV3_1" } ], "references": [ { "url": "https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc", "label": "https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc", "tags": [ "x_refsource_CONFIRM" ], "provider": "GitHub_M", "sourcePath": "/containers/cna/references/0" }, { "url": "https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable", "label": "https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable", "tags": [ "x_refsource_MISC" ], "provider": "GitHub_M", "sourcePath": "/containers/cna/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42208", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-42208", "label": "redhat-SADP", "tags": [ "vdb-entry", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463965", "label": "RHBZ#2463965", "tags": [ "issue-tracking", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/1" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42208.json", "label": "redhat-SADP", "tags": [ "x_sadp-csaf-vex" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/2" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42208.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"BerriAI\",\"product\":\"litellm\",\"versions\":[{\"version\":\">= 1.81.16, < 1.83.7\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42208.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before version 1.83.7, a database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. An unauthenticated attacker could send a specially crafted Authorization header to any LLM API route (for example POST /chat/completions) and reach this query through the proxy's error-handling path. An attacker could read data from the proxy's database and may be able to modify it, leading to unauthorised access to the proxy and the credentials it manages. This issue has been patched in version 1.83.7.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42208.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-89\",\"lang\":\"en\",\"description\":\"CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42208.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"baseScore\":9.3,\"baseSeverity\":\"CRITICAL\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\",\"version\":\"4.0\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/1/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42208.json", "sourcePath": "/containers/adp/1/metrics/1/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-07-15T00:58:03.861Z", "fetchedAt": "2026-10-23T02:43:48.921Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-05-08T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "litellmにデータベースへの不正操作に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "データベースに不正な命令を送られ、情報の閲覧や変更につながる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:23:44.242Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "785de8c441b55bd41989774a13d324a05088ba92834bd0dde30c753e1f5410e7", "sourceModifiedAt": "2026-07-15T00:58:03.861Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "LiteLLMはAIゲートウェイとしてLLM APIを呼び出すプロキシサーバーです。バージョン1.81.16から1.83.7未満までの間、プロキシのAPIキー検証で呼び出し側が提供したキーをSQLクエリ文字列に直接埋め込んでおり、認証されていない攻撃者が細工したAuthorizationヘッダーを任意のLLM APIルート（例：POST /chat/completions）に送ると、プロキシのエラーハンドリング経路を通ってこのクエリが実行されます。その結果、攻撃者はデータベースのデータを読み取れ、場合によっては書き換えることができ、プロキシや管理している認証情報への不正アクセスにつながります。この問題はバージョン1.83.7で修正されています。", "risk": "攻撃者がデータベースのデータを読み取れ、書き換えることができるため、プロキシへの不正アクセスや管理認証情報の漏洩が起こる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "LiteLLMはAIゲートウェイとしてLLM APIを呼び出すプロキシサーバーである。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42208.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "バージョン1.81.16以上、1.83.7未満のLiteLLMが対象である。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42208.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "プロキシのAPIキー検証時に、呼び出し側が提供したキーの値をSQLクエリ文字列に直接埋め込んでいる。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42208.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "キーが別パラメータとして渡されていないためSQLインジェクションが可能になる。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42208.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "認証されていない攻撃者が任意のLLM APIエンドポイント（例：POST /chat/completions）に細工したAuthorizationヘッダーを送信できる。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42208.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "そのリクエストはプロキシのエラーハンドリング経路を通って上記のSQLクエリに到達する。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42208.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "攻撃者はプロキシのデータベースからデータを読み取れる可能性がある。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42208.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "攻撃者はデータベースを書き換えることができる可能性があり、プロキシおよび管理している認証情報への不正アクセスにつながる恐れがある。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42208.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "本脆弱性はバージョン1.83.7で修正されている。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42208.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：BerriAI / litellm。影響ありとして記載：>= 1.81.16, < 1.83.7。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42208.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-42208" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42208.json" ], "evidenceIds": [ "E3" ] }, { "text": "「litellm」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-42208", "https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc", "https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-42208", "https://nvd.nist.gov/vuln/detail/CVE-2026-42208" ] } ], "actions": [ { "text": "バージョン1.83.7にアップグレードする。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42208.json" ], "evidenceIds": [ "E1" ] }, { "text": "「CVE-2026-42208」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-42208", "https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc", "https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-42208", "https://nvd.nist.gov/vuln/detail/CVE-2026-42208" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-42208", "https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc", "https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-42208", "https://nvd.nist.gov/vuln/detail/CVE-2026-42208" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-42208", "https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc", "https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-42208", "https://nvd.nist.gov/vuln/detail/CVE-2026-42208" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42208.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-42208", "https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc", "https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-42208", "https://nvd.nist.gov/vuln/detail/CVE-2026-42208" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42208.json", "label": "CVE：GitHub_M" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-42208", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-42208", "label": "CVE公式レコード" }, { "url": "https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc", "label": "CISAが示す関連情報" }, { "url": "https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable", "label": "https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42208", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42208.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before version 1.83.7, a database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. An unauthenticated attacker could send a specially crafted Authorization header to any LLM API route (for example POST /chat/completions) and reach this query through the proxy's error-handling path. An attacker could read data from the proxy's database and may be able to modify it, leading to unauthorised access to the proxy and the credentials it manages. This issue has been patched in version 1.83.7.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42208.json", "sourceField": "/containers/cna/title", "excerpt": "LiteLLM: SQL injection in Proxy API key verification", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42208.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"BerriAI\",\"product\":\"litellm\",\"versions\":[{\"version\":\">= 1.81.16, < 1.83.7\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-42208", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-42208\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-42208（litellm）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・LiteLLMはAIゲートウェイとしてLLM APIを呼び出すプロキシサーバーである。\n・バージョン1.81.16以上、1.83.7未満のLiteLLMが対象である。\n・プロキシのAPIキー検証時に、呼び出し側が提供したキーの値をSQLクエリ文字列に直接埋め込んでいる。\n・キーが別パラメータとして渡されていないためSQLインジェクションが可能になる。\n・認証されていない攻撃者が任意のLLM APIエンドポイント（例：POST /chat/completions）に細工したAuthorizationヘッダーを送信できる。\n・そのリクエストはプロキシのエラーハンドリング経路を通って上記のSQLクエリに到達する。\n・攻撃者はプロキシのデータベースからデータを読み取れる可能性がある。\n・攻撃者はデータベースを書き換えることができる可能性があり、プロキシおよび管理している認証情報への不正アクセスにつながる恐れがある。\n・本脆弱性はバージョン1.83.7で修正されている。\n・公式の対象表：BerriAI / litellm。影響ありとして記載：>= 1.81.16, < 1.83.7。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-42208", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:23:44.242Z", "lastSuccess": "2026-10-23T03:23:44.242Z", "sourceCheckedAt": "2026-10-23T02:43:48.921Z", "errorCode": null }, "glossary": [ { "term": "POST", "meaning": "フォームなどのデータを、相手のサーバーへ送るための通信方法です。この言葉だけで、情報漏えいや設定変更が起きたと判断するものではありません。", "sourceUrl": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Methods/POST", "kind": "general_definition" }, { "term": "SQLインジェクション", "meaning": "入力した値がデータベースへの命令として扱われ、意図しない問い合わせや操作をされる問題です。読み取り・書き換えなど、可能なことは脆弱性ごとに異なります。", "sourceUrl": "https://cwe.mitre.org/data/definitions/89.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-7262", "aliases": [ "GHSA-hmxp-6pc4-f3vv" ], "title": "PHP：サービス停止", "summary": "PHP の SOAP サーバーで typemap が設定されていると、apache:Map の 要素が欠如した場合にデコード処理が誤った変数をチェックし、NULL ポインタ参照が発生してセグメンテーションフォルトとなります。この欠陥により、リモートの認証されていない攻撃者が PHP SOAP サーバーをクラッシュさせ、サービスが利用できなくなる可能性があります。", "risk": "リモートの認証されていない攻撃者が PHP SOAP サーバーをクラッシュさせ、サービスが利用できなくなる（Denial of Service）ことがあります。", "product": "PHP", "category": "php", "component": "core", "severity": "low", "cvss": 2.9, "cvssVersion": "4.0", "cvssSource": "php", "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/AU:Y/RE:M/U:Amber", "affected": [ { "product": "PHP", "range": "8.2.* / < 8.2.31" }, { "product": "PHP", "range": "8.3.* / < 8.3.31" }, { "product": "PHP", "range": "8.4.* / < 8.4.21" }, { "product": "PHP", "range": "8.5.* / < 8.5.6" }, { "product": "PHP", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。" } ], "fixed": [ "8.2.31", "8.3.31", "8.4.21", "8.5.6" ], "steps": [ "PHP 8.2.31、8.3.31、8.4.21、8.5.6 以降にアップデートすることでこの問題は修正されます。", "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7262.json", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-hmxp-6pc4-f3vv", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-7262", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2026-05-07T12:57:55.000Z", "modifiedAt": "2026-07-15T00:40:18.277Z", "fetchedAt": "2026-10-23T02:43:50.347Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, the decoding process contains a mistake which checks the wrong variable in case of missing value element.  This leads to dereferences a NULL pointer, causing a segmentation fault. This allows a remote unauthenticated attacker to crash the PHP SOAP server process, resulting in denial of service.", "sourceTitle": "NULL pointer dereference in SOAP apache:Map decoder with missing ", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "PHP Group", "product": "PHP", "packageName": "soap", "versions": [ { "status": "affected", "version": "8.2.*", "lessThan": "8.2.31", "versionType": "semver" }, { "status": "affected", "version": "8.3.*", "lessThan": "8.3.31", "versionType": "semver" }, { "status": "affected", "version": "8.4.*", "lessThan": "8.4.21", "versionType": "semver" }, { "status": "affected", "version": "8.5.*", "lessThan": "8.5.6", "versionType": "semver" } ], "defaultStatus": "affected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-7262", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7262.json", "fetchedAt": "2026-10-23T02:43:50.347Z", "publishedAt": "2026-05-10T04:00:09.382Z", "modifiedAt": "2026-07-15T00:40:18.277Z", "state": "published", "provider": "php", "title": "NULL pointer dereference in SOAP apache:Map decoder with missing ", "descriptions": [ { "lang": "en", "value": "In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, the decoding process contains a mistake which checks the wrong variable in case of missing value element.  This leads to dereferences a NULL pointer, causing a segmentation fault. This allows a remote unauthenticated attacker to crash the PHP SOAP server process, resulting in denial of service.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "`to_zval_map()` in `ext/soap/php_encoding.c` decodes `apache:Map` nodes. The `` branch correctly guards against missing keys, but the `` branch rechecks `xmlKey` instead of `xmlValue`:\r\n\r\nhttps://github.com/php/php-src/blob/0d9ff00394d9447992bb66ccb1cef3edf70576bd/ext/soap/php_encoding.c#L2780-L2788\r\n\r\nIn addition, `master_to_zval_int()` accesses `data->properties` without a `NULL` check, where `data` corresponds to the missing `` node. This branch is reachable when `SOAP_GLOBAL(typemap)` is set, i.e. when the SOAP server has a typemap configured. By embedding an `apache:Map` node with a missing `` node into the request, the process will segfault with a `NULL` pointer dereference violation. Under the described circumstances, DoS becomes trivial with the following example:", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hmxp-6pc4-f3vv" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "packageName": "soap", "defaultStatus": "affected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.2.*", "lessThan": "8.2.31", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.3.*", "lessThan": "8.3.31", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8.4.*", "lessThan": "8.4.21", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "8.5.*", "lessThan": "8.5.6", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package ext-soap; vulnerable range: < 8.2.31; patched versions: 8.2.31", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hmxp-6pc4-f3vv" }, { "lang": "en", "value": "Package ext-soap; vulnerable range: < 8.3.31; patched versions: 8.3.31", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hmxp-6pc4-f3vv" }, { "lang": "en", "value": "Package ext-soap; vulnerable range: < 8.4.21; patched versions: 8.4.21", "sourcePath": "/vulnerabilities/2/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hmxp-6pc4-f3vv" }, { "lang": "en", "value": "Package ext-soap; vulnerable range: < 8.5.6; patched versions: 8.5.6", "sourcePath": "/vulnerabilities/3/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hmxp-6pc4-f3vv" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-476", "lang": "en", "description": "CWE-476 NULL pointer dereference", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/AU:Y/RE:M/U:Amber", "baseScore": 2.9, "baseSeverity": "LOW", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" }, { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/metrics/1/cvssV3_1" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-hmxp-6pc4-f3vv", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-7262", "label": "redhat-SADP", "tags": [ "vdb-entry", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468565", "label": "RHBZ#2468565", "tags": [ "issue-tracking", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/1" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7262.json", "label": "redhat-SADP", "tags": [ "x_sadp-csaf-vex" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/2" }, { "url": "https://access.redhat.com/errata/RHSA-2026:23388", "label": "redhat-SADP", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/3" }, { "url": "https://access.redhat.com/errata/RHSA-2026:22649", "label": "redhat-SADP", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/4" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34354", "label": "redhat-SADP", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/5" }, { "url": "https://access.redhat.com/errata/RHSA-2026:22305", "label": "redhat-SADP", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/6" }, { "url": "https://access.redhat.com/errata/RHSA-2026:22142", "label": "redhat-SADP", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/7" }, { "url": "https://access.redhat.com/errata/RHSA-2026:22143", "label": "redhat-SADP", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/8" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33449", "label": "redhat-SADP", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/9" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7262.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"PHP Group\",\"product\":\"PHP\",\"packageName\":\"soap\",\"versions\":[{\"status\":\"affected\",\"version\":\"8.2.*\",\"lessThan\":\"8.2.31\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.3.*\",\"lessThan\":\"8.3.31\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.4.*\",\"lessThan\":\"8.4.21\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.5.*\",\"lessThan\":\"8.5.6\",\"versionType\":\"semver\"}],\"defaultStatus\":\"affected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7262.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, the decoding process contains a mistake which checks the wrong variable in case of missing value element.  This leads to dereferences a NULL pointer, causing a segmentation fault. This allows a remote unauthenticated attacker to crash the PHP SOAP server process, resulting in denial of service.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7262.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-476\",\"description\":\"CWE-476 NULL pointer dereference\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7262.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"LOW\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"PROOF_OF_CONCEPT\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"YES\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"MODERATE\",\"providerUrgency\":\"AMBER\",\"version\":\"4.0\",\"baseSeverity\":\"LOW\",\"baseScore\":2.9,\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/AU:Y/RE:M/U:Amber\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/1/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7262.json", "sourcePath": "/containers/adp/1/metrics/1/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-hmxp-6pc4-f3vv:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hmxp-6pc4-f3vv", "sourcePath": "/description", "text": "`to_zval_map()` in `ext/soap/php_encoding.c` decodes `apache:Map` nodes. The `` branch correctly guards against missing keys, but the `` branch rechecks `xmlKey` instead of `xmlValue`:\r\n\r\nhttps://github.com/php/php-src/blob/0d9ff00394d9447992bb66ccb1cef3edf70576bd/ext/soap/php_encoding.c#L2780-L2788\r\n\r\nIn addition, `master_to_zval_int()` accesses `data->properties` without a `NULL` check, where `data` corresponds to the missing `` node. This branch is reachable when `SOAP_GLOBAL(typemap)` is set, i.e. when the SOAP server has a typemap configured. By embedding an `apache:Map` node with a missing `` node into the request, the process will segfault with a `NULL` pointer dereference violation. Under the described circumstances, DoS becomes trivial with the following example:", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-hmxp-6pc4-f3vv:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hmxp-6pc4-f3vv", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-soap\"},\"vulnerable_version_range\":\"< 8.2.31\",\"patched_versions\":\"8.2.31\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-hmxp-6pc4-f3vv:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hmxp-6pc4-f3vv", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-soap\"},\"vulnerable_version_range\":\"< 8.3.31\",\"patched_versions\":\"8.3.31\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-hmxp-6pc4-f3vv:/vulnerabilities/2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hmxp-6pc4-f3vv", "sourcePath": "/vulnerabilities/2", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-soap\"},\"vulnerable_version_range\":\"< 8.4.21\",\"patched_versions\":\"8.4.21\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-hmxp-6pc4-f3vv:/vulnerabilities/3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hmxp-6pc4-f3vv", "sourcePath": "/vulnerabilities/3", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-soap\"},\"vulnerable_version_range\":\"< 8.5.6\",\"patched_versions\":\"8.5.6\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2026-07-15T00:40:18.277Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-hmxp-6pc4-f3vv", "modifiedAt": "2026-05-07T12:57:55.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-07-15T00:40:18.277Z", "fetchedAt": "2026-10-23T02:43:50.347Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2026-05-07T12:57:55.000Z", "fetchedAt": "2026-10-22T22:18:00.744Z", "state": "published" } ], "sourceSummary": "PHPにサービス停止に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "処理の停止や過大な負荷により、サービスを利用できなくなる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:23:44.496Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "d3a63486676a75436ef20c3fd951ee7f824f057109dc2cdea319287f4628c6d3", "sourceModifiedAt": "2026-07-15T00:40:18.277Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "PHP の SOAP サーバーで typemap が設定されていると、apache:Map の 要素が欠如した場合にデコード処理が誤った変数をチェックし、NULL ポインタ参照が発生してセグメンテーションフォルトとなります。この欠陥により、リモートの認証されていない攻撃者が PHP SOAP サーバーをクラッシュさせ、サービスが利用できなくなる可能性があります。", "risk": "リモートの認証されていない攻撃者が PHP SOAP サーバーをクラッシュさせ、サービスが利用できなくなる（Denial of Service）ことがあります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "PHP 8.2 系（8.2.31 未満）で、SOAP サーバーに typemap が設定されている場合に影響があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7262.json" ], "evidenceIds": [ "E3", "E1", "E2" ] }, { "text": "PHP 8.3 系（8.3.31 未満）で、SOAP サーバーに typemap が設定されている場合に影響があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7262.json" ], "evidenceIds": [ "E3", "E1", "E2" ] }, { "text": "PHP 8.4 系（8.4.21 未満）で、SOAP サーバーに typemap が設定されている場合に影響があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7262.json" ], "evidenceIds": [ "E3", "E1", "E2" ] }, { "text": "PHP 8.5 系（8.5.6 未満）で、SOAP サーバーに typemap が設定されている場合に影響があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7262.json" ], "evidenceIds": [ "E3", "E1", "E2" ] }, { "text": "公式の対象表：PHP Group / PHP。影響ありとして記載：8.2系のうち、8.2.31未満。影響ありとして記載：8.3系のうち、8.3.31未満。影響ありとして記載：8.4系のうち、8.4.21未満。影響ありとして記載：8.5系のうち、8.5.6未満。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7262.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7262.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "PHP 8.2.31、8.3.31、8.4.21、8.5.6 以降にアップデートすることでこの問題は修正されます。", "kind": "fix", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-hmxp-6pc4-f3vv" ], "evidenceIds": [ "E4" ] }, { "text": "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php", "https://www.php.net/supported-versions.php", "https://documentation.ubuntu.com/security/security-updates/" ] } ], "temporaryMitigations": [ { "text": "自分でPHPの設定値を変更する前に、サーバー会社へ「このCVEに有効な回避策・副作用・修正予定」を確認してください。下の問い合わせ文を使えます。一般的なWAFやバックアップだけで修正済みとは扱わないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-7262", "https://github.com/php/php-src/security/advisories/GHSA-hmxp-6pc4-f3vv" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7262.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "公式タイトルにある名称は「NULL pointer dereference in SOAP apache:Map decoder with missing」、対象データの製品名は「PHP」です。同じ製品の別名かどうかは、この表記だけで決めず、開発元・製品識別子も添えて照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7262.json", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-hmxp-6pc4-f3vv", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-7262", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7262.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, the decoding process contains a mistake which checks the wrong variable in case of missing value element.  This leads to dereferences a NULL pointer, causing a segmentation fault. This allows a remote unauthenticated attacker to crash the PHP SOAP server process, resulting in denial of service.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7262.json", "sourceField": "/containers/cna/title", "excerpt": "NULL pointer dereference in SOAP apache:Map decoder with missing ", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7262.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"PHP Group\",\"product\":\"PHP\",\"packageName\":\"soap\",\"versions\":[{\"status\":\"affected\",\"version\":\"8.2.*\",\"lessThan\":\"8.2.31\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.3.*\",\"lessThan\":\"8.3.31\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.4.*\",\"lessThan\":\"8.4.21\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.5.*\",\"lessThan\":\"8.5.6\",\"versionType\":\"semver\"}],\"defaultStatus\":\"affected\"}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-hmxp-6pc4-f3vv", "sourceField": "/fixed", "excerpt": "[\"8.2.31\",\"8.3.31\",\"8.4.21\",\"8.5.6\"]", "language": null } ], "supportRequest": "件名：CVE-2026-7262（PHP）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・PHP 8.2 系（8.2.31 未満）で、SOAP サーバーに typemap が設定されている場合に影響があります。\n・PHP 8.3 系（8.3.31 未満）で、SOAP サーバーに typemap が設定されている場合に影響があります。\n・PHP 8.4 系（8.4.21 未満）で、SOAP サーバーに typemap が設定されている場合に影響があります。\n・PHP 8.5 系（8.5.6 未満）で、SOAP サーバーに typemap が設定されている場合に影響があります。\n・公式の対象表：PHP Group / PHP。影響ありとして記載：8.2系のうち、8.2.31未満。影響ありとして記載：8.3系のうち、8.3.31未満。影響ありとして記載：8.4系のうち、8.4.21未満。影響ありとして記載：8.5系のうち、8.5.6未満。個別に例外が記されていない版も、原資料では影響ありとされています。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-7262", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:23:44.496Z", "lastSuccess": "2026-10-23T03:23:44.496Z", "sourceCheckedAt": "2026-10-23T02:43:50.347Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-7261", "aliases": [ "GHSA-m33r-qmcv-p97q" ], "title": "PHP：情報の漏えい", "summary": "PHP の SoapServer を SOAP_PERSISTENCE_SESSION で設定すると、ハンドラオブジェクトがセッションに保存されますが、SOAP リクエストでエラーが発生した場合に保存処理が誤ってオブジェクトを解放したままポインタを残してしまい、use‑after‑free が発生します。これによりメモリ破壊、情報漏洩、プロセスのクラッシュが起こり、機密性・完全性・可用性に影響を与える可能性があります。", "risk": "メモリ破壊、情報漏洩、プロセスのクラッシュが起こり、機密性・完全性・可用性に影響を与える可能性があります。", "product": "PHP", "category": "php", "component": "core", "severity": "medium", "cvss": 6.3, "cvssVersion": "4.0", "cvssSource": "php", "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/S:P/AU:Y/RE:M/U:Amber", "affected": [ { "product": "PHP", "range": "8.2.* / < 8.2.31" }, { "product": "PHP", "range": "8.3.* / < 8.3.31" }, { "product": "PHP", "range": "8.4.* / < 8.4.21" }, { "product": "PHP", "range": "8.5.* / < 8.5.6" }, { "product": "PHP", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。" } ], "fixed": [ "8.2.31", "8.3.31", "8.4.21", "8.5.6" ], "steps": [ "PHP 8.2.31、8.3.31、8.4.21、8.5.6 にアップデートすることで修正されます。", "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7261.json", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-m33r-qmcv-p97q", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-7261", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2026-05-07T12:57:35.000Z", "modifiedAt": "2026-05-11T13:14:26.451Z", "fetchedAt": "2026-10-23T02:43:50.264Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across requests via session storage. However, in the case SOAP requests results in an error, the persistance is handled incorrectly, resulting in freeing the object while keeping a pointer to it, which may lead to use-after-free. This may lead to memory corruption, information disclosure, or process crashes, with confidentiality, integrity, and availability impact on the vulnerable system.", "sourceTitle": "SoapServer session-persisted object use-after-free via SOAP header fault", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "PHP Group", "product": "PHP", "packageName": "soap", "versions": [ { "status": "affected", "version": "8.2.*", "lessThan": "8.2.31", "versionType": "semver" }, { "status": "affected", "version": "8.3.*", "lessThan": "8.3.31", "versionType": "semver" }, { "status": "affected", "version": "8.4.*", "lessThan": "8.4.21", "versionType": "semver" }, { "status": "affected", "version": "8.5.*", "lessThan": "8.5.6", "versionType": "semver" } ], "defaultStatus": "affected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-7261", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7261.json", "fetchedAt": "2026-10-23T02:43:50.264Z", "publishedAt": "2026-05-10T04:07:25.484Z", "modifiedAt": "2026-05-11T13:14:26.451Z", "state": "published", "provider": "php", "title": "SoapServer session-persisted object use-after-free via SOAP header fault", "descriptions": [ { "lang": "en", "value": "In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across requests via session storage. However, in the case SOAP requests results in an error, the persistance is handled incorrectly, resulting in freeing the object while keeping a pointer to it, which may lead to use-after-free. This may lead to memory corruption, information disclosure, or process crashes, with confidentiality, integrity, and availability impact on the vulnerable system.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "`SOAP_PERSISTENCE_SESSION` allows to persist the SOAP handler object between requests using the session storage. Normally the object is immediately released after `SoapServer::handle()`, unless this setting is specified. This differentiation happens with the `service->soap_class.persistence != SOAP_PERSISTENCE_SESSION` check. `soap.c` fails to account for this flag in two places: \r\n\r\nhttps://github.com/php/php-src/blob/0d9ff00394d9447992bb66ccb1cef3edf70576bd/ext/soap/soap.c#L1595\r\n\r\nhttps://github.com/php/php-src/blob/0d9ff00394d9447992bb66ccb1cef3edf70576bd/ext/soap/soap.c#L1600\r\n\r\nBoth of them are failure cases when a handler function for a header node either returned `false` or threw an exception. When the session is written, the freed object will be read and written to the session storage, resulting in a use-after-free. Normally, a SOAP server will only handle one SOAP request per PHP request, so it's unlikely that the attacker will be able to control the freed memory segment, though it is not impossible.\r\n\r\nThe following example demonstrates the use-after-free.", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-m33r-qmcv-p97q" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "packageName": "soap", "defaultStatus": "affected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.2.*", "lessThan": "8.2.31", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.3.*", "lessThan": "8.3.31", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8.4.*", "lessThan": "8.4.21", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "8.5.*", "lessThan": "8.5.6", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package ext-soap; vulnerable range: < 8.2.31; patched versions: 8.2.31", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-m33r-qmcv-p97q" }, { "lang": "en", "value": "Package ext-soap; vulnerable range: < 8.3.31; patched versions: 8.3.31", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-m33r-qmcv-p97q" }, { "lang": "en", "value": "Package ext-soap; vulnerable range: < 8.4.21; patched versions: 8.4.21", "sourcePath": "/vulnerabilities/2/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-m33r-qmcv-p97q" }, { "lang": "en", "value": "Package ext-soap; vulnerable range: < 8.5.6; patched versions: 8.5.6", "sourcePath": "/vulnerabilities/3/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-m33r-qmcv-p97q" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-416", "lang": "en", "description": "CWE-416 Use after free", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/S:P/AU:Y/RE:M/U:Amber", "baseScore": 6.3, "baseSeverity": "MEDIUM", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-m33r-qmcv-p97q", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7261.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"PHP Group\",\"product\":\"PHP\",\"packageName\":\"soap\",\"versions\":[{\"status\":\"affected\",\"version\":\"8.2.*\",\"lessThan\":\"8.2.31\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.3.*\",\"lessThan\":\"8.3.31\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.4.*\",\"lessThan\":\"8.4.21\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.5.*\",\"lessThan\":\"8.5.6\",\"versionType\":\"semver\"}],\"defaultStatus\":\"affected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7261.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across requests via session storage. However, in the case SOAP requests results in an error, the persistance is handled incorrectly, resulting in freeing the object while keeping a pointer to it, which may lead to use-after-free. This may lead to memory corruption, information disclosure, or process crashes, with confidentiality, integrity, and availability impact on the vulnerable system.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7261.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-416\",\"description\":\"CWE-416 Use after free\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7261.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"LOW\",\"subConfidentialityImpact\":\"LOW\",\"vulnIntegrityImpact\":\"LOW\",\"subIntegrityImpact\":\"LOW\",\"vulnAvailabilityImpact\":\"LOW\",\"subAvailabilityImpact\":\"LOW\",\"exploitMaturity\":\"NOT_DEFINED\",\"Safety\":\"PRESENT\",\"Automatable\":\"YES\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"MODERATE\",\"providerUrgency\":\"AMBER\",\"version\":\"4.0\",\"baseSeverity\":\"MEDIUM\",\"baseScore\":6.3,\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/S:P/AU:Y/RE:M/U:Amber\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-m33r-qmcv-p97q:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-m33r-qmcv-p97q", "sourcePath": "/description", "text": "`SOAP_PERSISTENCE_SESSION` allows to persist the SOAP handler object between requests using the session storage. Normally the object is immediately released after `SoapServer::handle()`, unless this setting is specified. This differentiation happens with the `service->soap_class.persistence != SOAP_PERSISTENCE_SESSION` check. `soap.c` fails to account for this flag in two places: \r\n\r\nhttps://github.com/php/php-src/blob/0d9ff00394d9447992bb66ccb1cef3edf70576bd/ext/soap/soap.c#L1595\r\n\r\nhttps://github.com/php/php-src/blob/0d9ff00394d9447992bb66ccb1cef3edf70576bd/ext/soap/soap.c#L1600\r\n\r\nBoth of them are failure cases when a handler function for a header node either returned `false` or threw an exception. When the session is written, the freed object will be read and written to the session storage, resulting in a use-after-free. Normally, a SOAP server will only handle one SOAP request per PHP request, so it's unlikely that the attacker will be able to control the freed memory segment, though it is not impossible.\r\n\r\nThe following example demonstrates the use-after-free.", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-m33r-qmcv-p97q:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-m33r-qmcv-p97q", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-soap\"},\"vulnerable_version_range\":\"< 8.2.31\",\"patched_versions\":\"8.2.31\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-m33r-qmcv-p97q:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-m33r-qmcv-p97q", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-soap\"},\"vulnerable_version_range\":\"< 8.3.31\",\"patched_versions\":\"8.3.31\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-m33r-qmcv-p97q:/vulnerabilities/2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-m33r-qmcv-p97q", "sourcePath": "/vulnerabilities/2", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-soap\"},\"vulnerable_version_range\":\"< 8.4.21\",\"patched_versions\":\"8.4.21\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-m33r-qmcv-p97q:/vulnerabilities/3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-m33r-qmcv-p97q", "sourcePath": "/vulnerabilities/3", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-soap\"},\"vulnerable_version_range\":\"< 8.5.6\",\"patched_versions\":\"8.5.6\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2026-05-11T13:14:26.451Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-m33r-qmcv-p97q", "modifiedAt": "2026-05-07T12:57:35.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-05-11T13:14:26.451Z", "fetchedAt": "2026-10-23T02:43:50.264Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2026-05-07T12:57:35.000Z", "fetchedAt": "2026-10-22T22:18:00.744Z", "state": "published" } ], "sourceSummary": "PHPに情報の漏えいに関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来公開しない情報を読み取られる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:23:46.768Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "7ec8595198b645e3ceb5e15819a32cf25bdf504010d02bf5621e5fa94c2b2735", "sourceModifiedAt": "2026-05-11T13:14:26.451Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "PHP の SoapServer を SOAP_PERSISTENCE_SESSION で設定すると、ハンドラオブジェクトがセッションに保存されますが、SOAP リクエストでエラーが発生した場合に保存処理が誤ってオブジェクトを解放したままポインタを残してしまい、use‑after‑free が発生します。これによりメモリ破壊、情報漏洩、プロセスのクラッシュが起こり、機密性・完全性・可用性に影響を与える可能性があります。", "risk": "メモリ破壊、情報漏洩、プロセスのクラッシュが起こり、機密性・完全性・可用性に影響を与える可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "PHP 8.2.* で 8.2.31 未満が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7261.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "PHP 8.3.* で 8.3.31 未満が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7261.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "PHP 8.4.* で 8.4.21 未満が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7261.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "PHP 8.5.* で 8.5.6 未満が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7261.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "公式の対象表：PHP Group / PHP。影響ありとして記載：8.2系のうち、8.2.31未満。影響ありとして記載：8.3系のうち、8.3.31未満。影響ありとして記載：8.4系のうち、8.4.21未満。影響ありとして記載：8.5系のうち、8.5.6未満。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7261.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7261.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "PHP 8.2.31、8.3.31、8.4.21、8.5.6 にアップデートすることで修正されます。", "kind": "fix", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-m33r-qmcv-p97q" ], "evidenceIds": [ "E4" ] }, { "text": "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php", "https://www.php.net/supported-versions.php", "https://documentation.ubuntu.com/security/security-updates/" ] } ], "temporaryMitigations": [ { "text": "自分でPHPの設定値を変更する前に、サーバー会社へ「このCVEに有効な回避策・副作用・修正予定」を確認してください。下の問い合わせ文を使えます。一般的なWAFやバックアップだけで修正済みとは扱わないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-7261", "https://github.com/php/php-src/security/advisories/GHSA-m33r-qmcv-p97q" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7261.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7261.json", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-m33r-qmcv-p97q", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-7261", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7261.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across requests via session storage. However, in the case SOAP requests results in an error, the persistance is handled incorrectly, resulting in freeing the object while keeping a pointer to it, which may lead to use-after-free. This may lead to memory corruption, information disclosure, or process crashes, with confidentiality, integrity, and availability impact on the vulnerable system.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7261.json", "sourceField": "/containers/cna/title", "excerpt": "SoapServer session-persisted object use-after-free via SOAP header fault", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7261.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"PHP Group\",\"product\":\"PHP\",\"packageName\":\"soap\",\"versions\":[{\"status\":\"affected\",\"version\":\"8.2.*\",\"lessThan\":\"8.2.31\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.3.*\",\"lessThan\":\"8.3.31\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.4.*\",\"lessThan\":\"8.4.21\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.5.*\",\"lessThan\":\"8.5.6\",\"versionType\":\"semver\"}],\"defaultStatus\":\"affected\"}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-m33r-qmcv-p97q", "sourceField": "/fixed", "excerpt": "[\"8.2.31\",\"8.3.31\",\"8.4.21\",\"8.5.6\"]", "language": null } ], "supportRequest": "件名：CVE-2026-7261（PHP）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・PHP 8.2.* で 8.2.31 未満が影響を受けます。\n・PHP 8.3.* で 8.3.31 未満が影響を受けます。\n・PHP 8.4.* で 8.4.21 未満が影響を受けます。\n・PHP 8.5.* で 8.5.6 未満が影響を受けます。\n・公式の対象表：PHP Group / PHP。影響ありとして記載：8.2系のうち、8.2.31未満。影響ありとして記載：8.3系のうち、8.3.31未満。影響ありとして記載：8.4系のうち、8.4.21未満。影響ありとして記載：8.5系のうち、8.5.6未満。個別に例外が記されていない版も、原資料では影響ありとされています。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-7261", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:23:46.768Z", "lastSuccess": "2026-10-23T03:23:46.768Z", "sourceCheckedAt": "2026-10-23T02:43:50.264Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-7259", "aliases": [ "GHSA-wm6j-2649-pv75" ], "title": "PHP：サービス停止", "summary": "PHP バージョン 8.2.*（8.2.31 未満）、8.3.*（8.3.31 未満）、8.4.*（8.4.21 未満）、および 8.5.*（8.5.6 未満）において、Oniguruma と mbfl のエンコーディングリストの不一致が原因で NULL ポインタ参照が発生し、セグメンテーションフォルトとサービス拒否が起こります。ユーザーが制御できる入力が mb_regex_encoding() に渡すエンコーディングに影響を与える場合に、この脆弱性を悪用できます。", "risk": "NULL ポインタ参照によりセグメンテーションフォルトが発生し、PHP プロセスがクラッシュしてサービスが利用できなくなる（DoS）", "product": "PHP", "category": "php", "component": "core", "severity": "low", "cvss": 2.1, "cvssVersion": "4.0", "cvssSource": "php", "cvssVector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/AU:Y/U:Amber", "affected": [ { "product": "PHP", "range": "8.2.* / < 8.2.31" }, { "product": "PHP", "range": "8.3.* / < 8.3.31" }, { "product": "PHP", "range": "8.4.* / < 8.4.21" }, { "product": "PHP", "range": "8.5.* / < 8.5.6" }, { "product": "PHP", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。" } ], "fixed": [ "8.5.6", "8.4.21", "8.3.31", "8.2.31" ], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7259.json", "label": "CVE：php" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-7259", "label": "CVE公式レコード" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-wm6j-2649-pv75", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2026-05-07T12:57:13.000Z", "modifiedAt": "2026-05-11T13:13:50.416Z", "fetchedAt": "2026-10-23T02:43:50.247Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to  a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when user-controlled input can influence the encoding passed to mb_regex_encoding().", "sourceTitle": "Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "PHP Group", "product": "PHP", "packageName": "mbstring", "versions": [ { "status": "affected", "version": "8.2.*", "lessThan": "8.2.31", "versionType": "semver" }, { "status": "affected", "version": "8.3.*", "lessThan": "8.3.31", "versionType": "semver" }, { "status": "affected", "version": "8.4.*", "lessThan": "8.4.21", "versionType": "semver" }, { "status": "affected", "version": "8.5.*", "lessThan": "8.5.6", "versionType": "semver" } ], "defaultStatus": "affected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-7259", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7259.json", "fetchedAt": "2026-10-23T02:43:50.247Z", "publishedAt": "2026-05-10T04:13:26.766Z", "modifiedAt": "2026-05-11T13:13:50.416Z", "state": "published", "provider": "php", "title": "Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()", "descriptions": [ { "lang": "en", "value": "In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to  a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when user-controlled input can influence the encoding passed to mb_regex_encoding().", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "The following PHP code triggers a segmentation fault due to a NULL pointer dereference:\r\n\r\n\r\n\r\nThe crash occurs due to a mismatch between Oniguruma and mbfl encoding support:\r\n\r\n1. **Oniguruma** (the regex library) supports `iso-8859-11` (Thai encoding)\r\n2. **mbfl** (mbstring's internal encoding library) does **NOT** support `iso-8859-11`\r\n\r\nhttps://github.com/php/php-src/blob/0d9ff00394d9447992bb66ccb1cef3edf70576bd/ext/mbstring/php_mbregex.c#L404-L413\r\n\r\nWhen `mb_regex_encoding('iso-8859-11')` is called:\r\n- `php_mb_regex_set_mbctype()` validates the encoding against Oniguruma → **succeeds**\r\n- `mbfl_name2encoding('iso-8859-11')` is called → returns **NULL**\r\n- `MBREX(current_mbctype_mbfl_encoding)` is set to **NULL**\r\n\r\nLater, when `mb_ereg_search_init()` calls `php_mb_check_encoding()`:\r\n- `php_mb_regex_get_mbctype_encoding()` returns NULL\r\n- `php_mb_check_encoding()` dereferences the `NULL` pointer → **SEGV**\r\n\r\nThis vulnerability allows a denial of service (DoS). An attacker can reliably crash a PHP process when user-controlled input influences the encoding passed to `mb_regex_encoding()` and the application subsequently uses mbregex search APIs.\r\n\r\nEnumeration of all Oniguruma-supported encodings vs mbfl support:\r\n\r\n| Encoding / aliases | Oniguruma | mbfl | Status |\r\n|--------------------|-----------|------|--------|\r\n| iso-8859-1 … iso-8859-10 | ✓ | ✓ | Safe |\r\n| iso-8859-11, ISO8859-11 | ✓ | ✗ | **CRASH** |\r\n| iso-8859-13 … iso-8859-16 | ✓ | ✓ | Safe |\r\n| EUC-JP aliases: UJIS | ✓ | ✗ | **CRASH** |\r\n| EUC-CN aliases: GB-2312 | ✓ | ✗ | **CRASH** |\r\n| KOI8 aliases: KOI-8R | ✓ | ✗ | **CRASH** |\r\n| ASCII aliases: US_ASCII, ISO646 | ✓ | ✗ | **CRASH** |\r\n| KOI8 (no suffix) | ✓ | ✗ | Safe (rejected by mb_regex_encoding()) |\r\n| All other encodings | ✓ | ✓ | Safe |\n\n### Credits\r\nViet Hoang Luu - The University of Melbourne\r\nAmirmohammad Pasdar - The University of Melbourne\r\nWachiraphan Charoenwet - The University of Melbourne\r\nShaanan Cohney - The University of Melbourne\r\nToby Murray - The University of Melbourne\r\nVan-Thuan Pham - The University of Melbourne", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-wm6j-2649-pv75" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "packageName": "mbstring", "defaultStatus": "affected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.2.*", "lessThan": "8.2.31", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.3.*", "lessThan": "8.3.31", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8.4.*", "lessThan": "8.4.21", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "8.5.*", "lessThan": "8.5.6", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package ext-mbstring; vulnerable range: < 8.5.6; patched versions: 8.5.6", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-wm6j-2649-pv75" }, { "lang": "en", "value": "Package ext-mbstring; vulnerable range: < 8.4.21; patched versions: 8.4.21", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-wm6j-2649-pv75" }, { "lang": "en", "value": "Package ext-mbstring; vulnerable range: < 8.3.31; patched versions: 8.3.31", "sourcePath": "/vulnerabilities/2/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-wm6j-2649-pv75" }, { "lang": "en", "value": "Package ext-mbstring; vulnerable range: < 8.2.31; patched versions: 8.2.31", "sourcePath": "/vulnerabilities/3/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-wm6j-2649-pv75" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-476", "lang": "en", "description": "CWE-476 NULL Pointer Dereference", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/AU:Y/U:Amber", "baseScore": 2.1, "baseSeverity": "LOW", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-wm6j-2649-pv75", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7259.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"PHP Group\",\"product\":\"PHP\",\"packageName\":\"mbstring\",\"versions\":[{\"status\":\"affected\",\"version\":\"8.2.*\",\"lessThan\":\"8.2.31\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.3.*\",\"lessThan\":\"8.3.31\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.4.*\",\"lessThan\":\"8.4.21\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.5.*\",\"lessThan\":\"8.5.6\",\"versionType\":\"semver\"}],\"defaultStatus\":\"affected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7259.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to  a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when user-controlled input can influence the encoding passed to mb_regex_encoding().", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7259.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-476\",\"description\":\"CWE-476 NULL Pointer Dereference\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7259.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"ACTIVE\",\"vulnConfidentialityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"LOW\",\"subAvailabilityImpact\":\"LOW\",\"exploitMaturity\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"YES\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"AMBER\",\"version\":\"4.0\",\"baseSeverity\":\"LOW\",\"baseScore\":2.1,\"vectorString\":\"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/AU:Y/U:Amber\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-wm6j-2649-pv75:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-wm6j-2649-pv75", "sourcePath": "/description", "text": "The following PHP code triggers a segmentation fault due to a NULL pointer dereference:\r\n\r\n\r\n\r\nThe crash occurs due to a mismatch between Oniguruma and mbfl encoding support:\r\n\r\n1. **Oniguruma** (the regex library) supports `iso-8859-11` (Thai encoding)\r\n2. **mbfl** (mbstring's internal encoding library) does **NOT** support `iso-8859-11`\r\n\r\nhttps://github.com/php/php-src/blob/0d9ff00394d9447992bb66ccb1cef3edf70576bd/ext/mbstring/php_mbregex.c#L404-L413\r\n\r\nWhen `mb_regex_encoding('iso-8859-11')` is called:\r\n- `php_mb_regex_set_mbctype()` validates the encoding against Oniguruma → **succeeds**\r\n- `mbfl_name2encoding('iso-8859-11')` is called → returns **NULL**\r\n- `MBREX(current_mbctype_mbfl_encoding)` is set to **NULL**\r\n\r\nLater, when `mb_ereg_search_init()` calls `php_mb_check_encoding()`:\r\n- `php_mb_regex_get_mbctype_encoding()` returns NULL\r\n- `php_mb_check_encoding()` dereferences the `NULL` pointer → **SEGV**\r\n\r\nThis vulnerability allows a denial of service (DoS). An attacker can reliably crash a PHP process when user-controlled input influences the encoding passed to `mb_regex_encoding()` and the application subsequently uses mbregex search APIs.\r\n\r\nEnumeration of all Oniguruma-supported encodings vs mbfl support:\r\n\r\n| Encoding / aliases | Oniguruma | mbfl | Status |\r\n|--------------------|-----------|------|--------|\r\n| iso-8859-1 … iso-8859-10 | ✓ | ✓ | Safe |\r\n| iso-8859-11, ISO8859-11 | ✓ | ✗ | **CRASH** |\r\n| iso-8859-13 … iso-8859-16 | ✓ | ✓ | Safe |\r\n| EUC-JP aliases: UJIS | ✓ | ✗ | **CRASH** |\r\n| EUC-CN aliases: GB-2312 | ✓ | ✗ | **CRASH** |\r\n| KOI8 aliases: KOI-8R | ✓ | ✗ | **CRASH** |\r\n| ASCII aliases: US_ASCII, ISO646 | ✓ | ✗ | **CRASH** |\r\n| KOI8 (no suffix) | ✓ | ✗ | Safe (rejected by mb_regex_encoding()) |\r\n| All other encodings | ✓ | ✓ | Safe |\n\n### Credits\r\nViet Hoang Luu - The University of Melbourne\r\nAmirmohammad Pasdar - The University of Melbourne\r\nWachiraphan Charoenwet - The University of Melbourne\r\nShaanan Cohney - The University of Melbourne\r\nToby Murray - The University of Melbourne\r\nVan-Thuan Pham - The University of Melbourne", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-wm6j-2649-pv75:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-wm6j-2649-pv75", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-mbstring\"},\"vulnerable_version_range\":\"< 8.5.6\",\"patched_versions\":\"8.5.6\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-wm6j-2649-pv75:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-wm6j-2649-pv75", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-mbstring\"},\"vulnerable_version_range\":\"< 8.4.21\",\"patched_versions\":\"8.4.21\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-wm6j-2649-pv75:/vulnerabilities/2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-wm6j-2649-pv75", "sourcePath": "/vulnerabilities/2", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-mbstring\"},\"vulnerable_version_range\":\"< 8.3.31\",\"patched_versions\":\"8.3.31\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-wm6j-2649-pv75:/vulnerabilities/3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-wm6j-2649-pv75", "sourcePath": "/vulnerabilities/3", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-mbstring\"},\"vulnerable_version_range\":\"< 8.2.31\",\"patched_versions\":\"8.2.31\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2026-05-11T13:13:50.416Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-wm6j-2649-pv75", "modifiedAt": "2026-05-07T12:57:13.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-05-11T13:13:50.416Z", "fetchedAt": "2026-10-23T02:43:50.247Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2026-05-07T12:57:13.000Z", "fetchedAt": "2026-10-22T22:18:00.744Z", "state": "published" } ], "sourceSummary": "PHPにサービス停止に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "処理の停止や過大な負荷により、サービスを利用できなくなる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:23:48.032Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "93bdbe828180ea2a17e4f359f783c434439f2d54e1b0e709d59c301de4b5ef96", "sourceModifiedAt": "2026-05-11T13:13:50.416Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "PHP バージョン 8.2.*（8.2.31 未満）、8.3.*（8.3.31 未満）、8.4.*（8.4.21 未満）、および 8.5.*（8.5.6 未満）において、Oniguruma と mbfl のエンコーディングリストの不一致が原因で NULL ポインタ参照が発生し、セグメンテーションフォルトとサービス拒否が起こります。ユーザーが制御できる入力が mb_regex_encoding() に渡すエンコーディングに影響を与える場合に、この脆弱性を悪用できます。", "risk": "NULL ポインタ参照によりセグメンテーションフォルトが発生し、PHP プロセスがクラッシュしてサービスが利用できなくなる（DoS）", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "PHP 8.2.* のうちバージョン 8.2.31 未満は影響あり", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7259.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "PHP 8.3.* のうちバージョン 8.3.31 未満は影響あり", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7259.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "PHP 8.4.* のうちバージョン 8.4.21 未満は影響あり", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7259.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "PHP 8.5.* のうちバージョン 8.5.6 未満は影響あり", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7259.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "公式の対象表：PHP Group / PHP。影響ありとして記載：8.2系のうち、8.2.31未満。影響ありとして記載：8.3系のうち、8.3.31未満。影響ありとして記載：8.4系のうち、8.4.21未満。影響ありとして記載：8.5系のうち、8.5.6未満。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7259.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7259.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7259.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "自分でPHPの設定値を変更する前に、サーバー会社へ「このCVEに有効な回避策・副作用・修正予定」を確認してください。下の問い合わせ文を使えます。一般的なWAFやバックアップだけで修正済みとは扱わないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-7259", "https://github.com/php/php-src/security/advisories/GHSA-wm6j-2649-pv75" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7259.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7259.json", "label": "CVE：php" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-7259", "label": "CVE公式レコード" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-wm6j-2649-pv75", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7259.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to  a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when user-controlled input can influence the encoding passed to mb_regex_encoding().", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7259.json", "sourceField": "/containers/cna/title", "excerpt": "Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7259.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"PHP Group\",\"product\":\"PHP\",\"packageName\":\"mbstring\",\"versions\":[{\"status\":\"affected\",\"version\":\"8.2.*\",\"lessThan\":\"8.2.31\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.3.*\",\"lessThan\":\"8.3.31\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.4.*\",\"lessThan\":\"8.4.21\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.5.*\",\"lessThan\":\"8.5.6\",\"versionType\":\"semver\"}],\"defaultStatus\":\"affected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-7259（PHP）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・PHP 8.2.* のうちバージョン 8.2.31 未満は影響あり\n・PHP 8.3.* のうちバージョン 8.3.31 未満は影響あり\n・PHP 8.4.* のうちバージョン 8.4.21 未満は影響あり\n・PHP 8.5.* のうちバージョン 8.5.6 未満は影響あり\n・公式の対象表：PHP Group / PHP。影響ありとして記載：8.2系のうち、8.2.31未満。影響ありとして記載：8.3系のうち、8.3.31未満。影響ありとして記載：8.4系のうち、8.4.21未満。影響ありとして記載：8.5系のうち、8.5.6未満。個別に例外が記されていない版も、原資料では影響ありとされています。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-7259", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:23:48.032Z", "lastSuccess": "2026-10-23T03:23:48.032Z", "sourceCheckedAt": "2026-10-23T02:43:50.247Z", "errorCode": null }, "glossary": [ { "term": "サービス拒否（DoS）", "meaning": "サービスや機能が停止したり、処理が遅くなったりして、通常どおり利用できなくなることです。", "sourceUrl": "https://cwe.mitre.org/data/definitions/400.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-6735", "aliases": [ "GHSA-7qg2-v9fj-4mwv" ], "title": "PHP：ブラウザー上での不正な処理", "summary": "PHP のバージョン 8.2.*（8.2.31 未満）、8.3.*（8.3.31 未満）、8.4.*（8.4.21 未満）、8.5.*（8.5.6 未満）において、ユーザー入力のサニタイズが不適切なため、攻撃者が特別に細工した URL を作成でき、対象が PHP‑FPM のステータスページを閲覧すると、そのページ上で任意の JavaScript が実行されます。", "risk": "攻撃者は被害者のブラウザー上で任意の JavaScript を実行でき、クッキーの取得やステータスページに含まれる情報の漏洩など、機密データが盗まれる可能性があります。", "product": "PHP", "category": "php", "component": "core", "severity": "high", "cvss": 7.3, "cvssVersion": "4.0", "cvssSource": "php", "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:P/S:P/AU:Y/RE:L/U:Amber", "affected": [ { "product": "PHP", "range": "8.2.* / < 8.2.31" }, { "product": "PHP", "range": "8.3.* / < 8.3.31" }, { "product": "PHP", "range": "8.4.* / < 8.4.21" }, { "product": "PHP", "range": "8.5.* / < 8.5.6" }, { "product": "PHP", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。" } ], "fixed": [ "8.2.31", "8.3.31", "8.4.21", "8.5.6" ], "steps": [ "PHP を 8.2.31、8.3.31、8.4.21、または 8.5.6 以上のバージョンにアップデートしてください。", "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6735.json", "label": "CVE：php" }, { "url": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7qg2-v9fj-4mwv", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-7qg2-v9fj-4mwv", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-6735", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2026-05-07T12:56:51.000Z", "modifiedAt": "2026-05-11T13:25:54.957Z", "fetchedAt": "2026-10-23T02:43:50.070Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM status page.", "sourceTitle": "XSS within PHP-FPM status endpoint", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "PHP Group", "product": "PHP", "versions": [ { "status": "affected", "version": "8.2.*", "lessThan": "8.2.31", "versionType": "semver" }, { "status": "affected", "version": "8.3.*", "lessThan": "8.3.31", "versionType": "semver" }, { "status": "affected", "version": "8.4.*", "lessThan": "8.4.21", "versionType": "semver" }, { "status": "affected", "version": "8.5.*", "lessThan": "8.5.6", "versionType": "semver" } ], "defaultStatus": "affected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-6735", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6735.json", "fetchedAt": "2026-10-23T02:43:50.070Z", "publishedAt": "2026-05-10T03:27:00.607Z", "modifiedAt": "2026-05-11T13:25:54.957Z", "state": "published", "provider": "php", "title": "XSS within PHP-FPM status endpoint", "descriptions": [ { "lang": "en", "value": "In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM status page.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Improper sanitization of the request URI within the PHP-FPM status page allows an attacker to execute arbitrary JavaScript code (XSS) on the victims machine, possibly stealing cookies on insufficiently hardened systems, or stealing other sensitive data such as the information from the status page itself. An attacker does not require authentication or access to the `/status` endpoint in order to trigger XSS, but may simply visit a URI embedding the malicious code.\r\n\r\n1. Navigate to `example.com/`\r\n2. Navigate to `example.com/status?full&html`\r\n3. Observe the JavaScript pop-up.\r\n\r\nThe same is possible for the XML endpoint, possibly embedding malicious XML nodes into the status report.\r\n\r\n1. Navigate to `example.com/<`\r\n2. Navigate to `example.com/status?full&xml`\r\n3. Observe the XML parsing error.", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7qg2-v9fj-4mwv" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "affected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.2.*", "lessThan": "8.2.31", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.3.*", "lessThan": "8.3.31", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8.4.*", "lessThan": "8.4.21", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "8.5.*", "lessThan": "8.5.6", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package PHP-FPM; vulnerable range: < 8.2.31; patched versions: 8.2.31", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7qg2-v9fj-4mwv" }, { "lang": "en", "value": "Package PHP-FPM; vulnerable range: < 8.3.31; patched versions: 8.3.31", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7qg2-v9fj-4mwv" }, { "lang": "en", "value": "Package PHP-FPM; vulnerable range: < 8.4.21; patched versions: 8.4.21", "sourcePath": "/vulnerabilities/2/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7qg2-v9fj-4mwv" }, { "lang": "en", "value": "Package PHP-FPM; vulnerable range: < 8.5.6; patched versions: 8.5.6", "sourcePath": "/vulnerabilities/3/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7qg2-v9fj-4mwv" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:P/S:P/AU:Y/RE:L/U:Amber", "baseScore": 7.3, "baseSeverity": "HIGH", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-7qg2-v9fj-4mwv", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6735.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"PHP Group\",\"product\":\"PHP\",\"versions\":[{\"status\":\"affected\",\"version\":\"8.2.*\",\"lessThan\":\"8.2.31\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.3.*\",\"lessThan\":\"8.3.31\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.4.*\",\"lessThan\":\"8.4.21\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.5.*\",\"lessThan\":\"8.5.6\",\"versionType\":\"semver\"}],\"defaultStatus\":\"affected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6735.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM status page.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6735.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-79\",\"description\":\"CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6735.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"PASSIVE\",\"vulnConfidentialityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"subIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"PROOF_OF_CONCEPT\",\"Safety\":\"PRESENT\",\"Automatable\":\"YES\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"LOW\",\"providerUrgency\":\"AMBER\",\"version\":\"4.0\",\"baseSeverity\":\"HIGH\",\"baseScore\":7.3,\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:P/S:P/AU:Y/RE:L/U:Amber\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-7qg2-v9fj-4mwv:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7qg2-v9fj-4mwv", "sourcePath": "/description", "text": "Improper sanitization of the request URI within the PHP-FPM status page allows an attacker to execute arbitrary JavaScript code (XSS) on the victims machine, possibly stealing cookies on insufficiently hardened systems, or stealing other sensitive data such as the information from the status page itself. An attacker does not require authentication or access to the `/status` endpoint in order to trigger XSS, but may simply visit a URI embedding the malicious code.\r\n\r\n1. Navigate to `example.com/`\r\n2. Navigate to `example.com/status?full&html`\r\n3. Observe the JavaScript pop-up.\r\n\r\nThe same is possible for the XML endpoint, possibly embedding malicious XML nodes into the status report.\r\n\r\n1. Navigate to `example.com/<`\r\n2. Navigate to `example.com/status?full&xml`\r\n3. Observe the XML parsing error.", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-7qg2-v9fj-4mwv:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7qg2-v9fj-4mwv", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"PHP-FPM\"},\"vulnerable_version_range\":\"< 8.2.31\",\"patched_versions\":\"8.2.31\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-7qg2-v9fj-4mwv:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7qg2-v9fj-4mwv", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"PHP-FPM\"},\"vulnerable_version_range\":\"< 8.3.31\",\"patched_versions\":\"8.3.31\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-7qg2-v9fj-4mwv:/vulnerabilities/2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7qg2-v9fj-4mwv", "sourcePath": "/vulnerabilities/2", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"PHP-FPM\"},\"vulnerable_version_range\":\"< 8.4.21\",\"patched_versions\":\"8.4.21\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-7qg2-v9fj-4mwv:/vulnerabilities/3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7qg2-v9fj-4mwv", "sourcePath": "/vulnerabilities/3", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"PHP-FPM\"},\"vulnerable_version_range\":\"< 8.5.6\",\"patched_versions\":\"8.5.6\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2026-05-11T13:25:54.957Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7qg2-v9fj-4mwv", "modifiedAt": "2026-05-07T12:56:51.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-05-11T13:25:54.957Z", "fetchedAt": "2026-10-23T02:43:50.070Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2026-05-07T12:56:51.000Z", "fetchedAt": "2026-10-22T22:18:00.744Z", "state": "published" } ], "sourceSummary": "PHPにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:23:48.122Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "03fa546488100e116882792aeaf06c3392ad084b8552aaf361efd2467bb1ccc9", "sourceModifiedAt": "2026-05-11T13:25:54.957Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "PHP のバージョン 8.2.*（8.2.31 未満）、8.3.*（8.3.31 未満）、8.4.*（8.4.21 未満）、8.5.*（8.5.6 未満）において、ユーザー入力のサニタイズが不適切なため、攻撃者が特別に細工した URL を作成でき、対象が PHP‑FPM のステータスページを閲覧すると、そのページ上で任意の JavaScript が実行されます。", "risk": "攻撃者は被害者のブラウザー上で任意の JavaScript を実行でき、クッキーの取得やステータスページに含まれる情報の漏洩など、機密データが盗まれる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E3" ], "applicability": [ { "text": "PHP 8.2 系でバージョンが 8.2.31 未満のものは影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6735.json", "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7qg2-v9fj-4mwv" ], "evidenceIds": [ "E4", "E5", "E2" ] }, { "text": "PHP 8.3 系でバージョンが 8.3.31 未満のものは影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6735.json", "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7qg2-v9fj-4mwv" ], "evidenceIds": [ "E4", "E6", "E2" ] }, { "text": "PHP 8.4 系でバージョンが 8.4.21 未満のものは影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6735.json", "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7qg2-v9fj-4mwv" ], "evidenceIds": [ "E4", "E7", "E2" ] }, { "text": "PHP 8.5 系でバージョンが 8.5.6 未満のものは影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6735.json", "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7qg2-v9fj-4mwv" ], "evidenceIds": [ "E4", "E8", "E2" ] }, { "text": "公式の対象表：PHP Group / PHP。影響ありとして記載：8.2系のうち、8.2.31未満。影響ありとして記載：8.3系のうち、8.3.31未満。影響ありとして記載：8.4系のうち、8.4.21未満。影響ありとして記載：8.5系のうち、8.5.6未満。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6735.json" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6735.json" ], "evidenceIds": [ "E4" ] }, { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "PHP を 8.2.31、8.3.31、8.4.21、または 8.5.6 以上のバージョンにアップデートしてください。", "kind": "fix", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-7qg2-v9fj-4mwv" ], "evidenceIds": [ "E9" ] }, { "text": "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php", "https://www.php.net/supported-versions.php", "https://documentation.ubuntu.com/security/security-updates/" ] } ], "temporaryMitigations": [ { "text": "自分でPHPの設定値を変更する前に、サーバー会社へ「このCVEに有効な回避策・副作用・修正予定」を確認してください。下の問い合わせ文を使えます。一般的なWAFやバックアップだけで修正済みとは扱わないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-6735", "https://github.com/php/php-src/security/advisories/GHSA-7qg2-v9fj-4mwv" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6735.json" ], "evidenceIds": [ "E4" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6735.json", "label": "CVE：php" }, { "url": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7qg2-v9fj-4mwv", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-7qg2-v9fj-4mwv", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-6735", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6735.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM status page.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6735.json", "sourceField": "/containers/cna/title", "excerpt": "XSS within PHP-FPM status endpoint", "language": null }, { "id": "E3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7qg2-v9fj-4mwv", "sourceField": "/description", "excerpt": "Improper sanitization of the request URI within the PHP-FPM status page allows an attacker to execute arbitrary JavaScript code (XSS) on the victims machine, possibly stealing cookies on insufficiently hardened systems, or stealing other sensitive data such as the information from the status page itself. An attacker does not require authentication or access to the `/status` endpoint in order to trigger XSS, but may simply visit a URI embedding the malicious code.\r\n\r\n1. Navigate to `example.com/`\r\n2. Navigate to `example.com/status?full&html`\r\n3. Observe the JavaScript pop-up.\r\n\r\nThe same is possible for the XML endpoint, possibly embedding malicious XML nodes into the status report.\r\n\r\n1. Navigate to `example.com/<`\r\n2. Navigate to `example.com/status?full&xml`\r\n3. Observe the XML parsing error.", "language": "en", "representation": "defensive_sections", "filtered": true }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6735.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"PHP Group\",\"product\":\"PHP\",\"versions\":[{\"status\":\"affected\",\"version\":\"8.2.*\",\"lessThan\":\"8.2.31\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.3.*\",\"lessThan\":\"8.3.31\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.4.*\",\"lessThan\":\"8.4.21\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.5.*\",\"lessThan\":\"8.5.6\",\"versionType\":\"semver\"}],\"defaultStatus\":\"affected\"}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7qg2-v9fj-4mwv", "sourceField": "/vulnerabilities/0", "excerpt": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"PHP-FPM\"},\"vulnerable_version_range\":\"< 8.2.31\",\"patched_versions\":\"8.2.31\",\"vulnerable_functions\":[]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7qg2-v9fj-4mwv", "sourceField": "/vulnerabilities/1", "excerpt": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"PHP-FPM\"},\"vulnerable_version_range\":\"< 8.3.31\",\"patched_versions\":\"8.3.31\",\"vulnerable_functions\":[]}", "language": null, "representation": "source_json" }, { "id": "E7", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7qg2-v9fj-4mwv", "sourceField": "/vulnerabilities/2", "excerpt": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"PHP-FPM\"},\"vulnerable_version_range\":\"< 8.4.21\",\"patched_versions\":\"8.4.21\",\"vulnerable_functions\":[]}", "language": null, "representation": "source_json" }, { "id": "E8", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7qg2-v9fj-4mwv", "sourceField": "/vulnerabilities/3", "excerpt": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"PHP-FPM\"},\"vulnerable_version_range\":\"< 8.5.6\",\"patched_versions\":\"8.5.6\",\"vulnerable_functions\":[]}", "language": null, "representation": "source_json" }, { "id": "E9", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-7qg2-v9fj-4mwv", "sourceField": "/fixed", "excerpt": "[\"8.2.31\",\"8.3.31\",\"8.4.21\",\"8.5.6\"]", "language": null } ], "supportRequest": "件名：CVE-2026-6735（PHP）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・PHP 8.2 系でバージョンが 8.2.31 未満のものは影響を受けます。\n・PHP 8.3 系でバージョンが 8.3.31 未満のものは影響を受けます。\n・PHP 8.4 系でバージョンが 8.4.21 未満のものは影響を受けます。\n・PHP 8.5 系でバージョンが 8.5.6 未満のものは影響を受けます。\n・公式の対象表：PHP Group / PHP。影響ありとして記載：8.2系のうち、8.2.31未満。影響ありとして記載：8.3系のうち、8.3.31未満。影響ありとして記載：8.4系のうち、8.4.21未満。影響ありとして記載：8.5系のうち、8.5.6未満。個別に例外が記されていない版も、原資料では影響ありとされています。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-6735", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:23:48.122Z", "lastSuccess": "2026-10-23T03:23:48.122Z", "sourceCheckedAt": "2026-10-23T02:43:50.070Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-6722", "aliases": [ "GHSA-85c2-q967-79q5" ], "title": "PHP：コード実行", "summary": "PHP のバージョン 8.2.*（8.2.31 未満）、8.3.*（8.3.31 未満）、8.4.*（8.4.21 未満）、8.5.*（8.5.6 未満）において、SOAP 拡張のオブジェクト重複除去機構が PHP オブジェクトへのポインタを参照カウントを増やさずにグローバルマップに保存します。apache:Map ノードに重複キーがあると、2 番目のエントリの処理で最初のエントリが上書きされ、元の PHP オブジェクトが解放されますが、マップ内には古いポインタが残ります。その後、href 参照が解放されたノードを指すと、古いポインタが結果にコピーされます。PHP の文字列割り当てが解放されたメモリ領域を再利用できるため、攻撃者が SOAP リクエスト本文を操作できれば、この use‑after‑free を利用してサーバー上で任意のコードを実行できる可能性があります。", "risk": "攻撃者が SOAP リクエスト本文を操作できた場合、リモートコード実行が可能になる恐れがあります。", "product": "PHP", "category": "php", "component": "core", "severity": "critical", "cvss": 9.5, "cvssVersion": "4.0", "cvssSource": "php", "cvssVector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/RE:M/U:Red", "affected": [ { "product": "PHP", "range": "8.2.* / < 8.2.31" }, { "product": "PHP", "range": "8.3.* / < 8.3.31" }, { "product": "PHP", "range": "8.4.* / < 8.4.21" }, { "product": "PHP", "range": "8.5.* / < 8.5.6" }, { "product": "PHP", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。" } ], "fixed": [ "8.2.31", "8.3.31", "8.4.21", "8.5.6" ], "steps": [ "PHP を 8.2.31、8.3.31、8.4.21、または 8.5.6 以上にアップデートして修正してください。", "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6722.json", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-6722", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2026-05-07T12:56:25.000Z", "modifiedAt": "2026-07-23T12:08:11.781Z", "fetchedAt": "2026-10-23T02:43:50.025Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.", "sourceTitle": "Use-After-Free in SOAP using Apache map", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "PHP Group", "product": "PHP", "packageName": "soap", "versions": [ { "status": "affected", "version": "8.2.*", "lessThan": "8.2.31", "versionType": "semver" }, { "status": "affected", "version": "8.3.*", "lessThan": "8.3.31", "versionType": "semver" }, { "status": "affected", "version": "8.4.*", "lessThan": "8.4.21", "versionType": "semver" }, { "status": "affected", "version": "8.5.*", "lessThan": "8.5.6", "versionType": "semver" } ], "defaultStatus": "affected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-6722", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6722.json", "fetchedAt": "2026-10-23T02:43:50.025Z", "publishedAt": "2026-05-10T04:19:15.288Z", "modifiedAt": "2026-07-23T12:08:11.781Z", "state": "published", "provider": "php", "title": "Use-After-Free in SOAP using Apache map", "descriptions": [ { "lang": "en", "value": "In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "ext-soap supports deduplicating objects in the XML graph through `id` and `href`. When traversing the XML graph, ext-soap will remember all plain PHP objects using the hash map `SOAP_GLOBAL(ref_map)`, where the pointer to the libxml2 node acts as a key, and the PHP object as a value. This happens in `soap_add_xml_ref()`.\r\n\r\nhttps://github.com/php/php-src/blob/dcf653339c245e25ea319248d0fc071a9405d688/ext/soap/php_encoding.c#L349-L354\r\n\r\nCrucially, the reference count of the PHP object is _not_ increased. Normally this is not a problem, as all objects in the XML graph are stored in the resulting object graph and cannot be freed.\r\n\r\n`soap_check_xml_ref()` does the opposite of `soap_add_xml_ref()`; it will check whether some libxml2 node as already been evaluated and stored in `SOAP_GLOBAL(ref_map)`.\r\n\r\nhttps://github.com/php/php-src/blob/dcf653339c245e25ea319248d0fc071a9405d688/ext/soap/php_encoding.c#L331-L347\r\n\r\nThe Apache map offers a mechanism to free objects between these two points by overwriting existing map entries.\r\n\r\n\r\n\r\nThis example will:\r\n\r\n- evaluate the `map` node\r\n- evaluate the `Stale` object, which includes calling calling `soap_add_xml_ref()` to remember it in `SOAP_GLOBAL(ref_map)`\r\n- add the resulting object to a temporary map, which will be the result of the Apache map node\r\n- overwrite the object immediately with `NULL` for the `` with an empty ``, releasing the `Stale` object only strongly referenced by the temporary map, with the reference in `SOAP_GLOBAL(ref_map)` becoming stale\r\n- have `` refer to this stale pointer within `SOAP_GLOBAL(ref_map)`, reusing the freed memory\r\n\r\nAfter this code, `$result` will refer to the stale memory where `Stale` was previously allocated. The attacker has high control over this memory segment by subsequently allocating plain strings, leading to Remote Code Execution.\r\n\r\nThe solution is straight forward, namely increase the reference count before adding objects to `SOAP_GLOBAL(ref_map)`, and configure a `ZVAL_PTR_DTOR` deallocator to release the objects when the procedure is done.", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-85c2-q967-79q5" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "packageName": "soap", "defaultStatus": "affected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.2.*", "lessThan": "8.2.31", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.3.*", "lessThan": "8.3.31", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8.4.*", "lessThan": "8.4.21", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "8.5.*", "lessThan": "8.5.6", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package ext-soap; vulnerable range: < 8.2.31; patched versions: 8.2.31", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-85c2-q967-79q5" }, { "lang": "en", "value": "Package ext-soap; vulnerable range: < 8.3.31; patched versions: 8.3.31", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-85c2-q967-79q5" }, { "lang": "en", "value": "Package ext-soap; vulnerable range: < 8.4.21; patched versions: 8.4.21", "sourcePath": "/vulnerabilities/2/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-85c2-q967-79q5" }, { "lang": "en", "value": "Package ext-soap; vulnerable range: < 8.5.6; patched versions: 8.5.6", "sourcePath": "/vulnerabilities/3/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-85c2-q967-79q5" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-416", "lang": "en", "description": "CWE-416 Use After Free", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/RE:M/U:Red", "baseScore": 9.5, "baseSeverity": "CRITICAL", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" }, { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "baseScore": 7.7, "baseSeverity": "HIGH", "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/metrics/1/cvssV3_1" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-6722", "label": "redhat-SADP", "tags": [ "vdb-entry", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468560", "label": "RHBZ#2468560", "tags": [ "issue-tracking", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/1" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6722.json", "label": "redhat-SADP", "tags": [ "x_sadp-csaf-vex" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/2" }, { "url": "https://access.redhat.com/errata/RHSA-2026:23388", "label": "redhat-SADP", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/3" }, { "url": "https://access.redhat.com/errata/RHSA-2026:22649", "label": "redhat-SADP", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/4" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34354", "label": "redhat-SADP", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/5" }, { "url": "https://access.redhat.com/errata/RHSA-2026:22305", "label": "redhat-SADP", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/6" }, { "url": "https://access.redhat.com/errata/RHSA-2026:22142", "label": "redhat-SADP", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/7" }, { "url": "https://access.redhat.com/errata/RHSA-2026:22143", "label": "redhat-SADP", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/8" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33449", "label": "redhat-SADP", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/9" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6722.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"PHP Group\",\"product\":\"PHP\",\"packageName\":\"soap\",\"versions\":[{\"status\":\"affected\",\"version\":\"8.2.*\",\"lessThan\":\"8.2.31\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.3.*\",\"lessThan\":\"8.3.31\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.4.*\",\"lessThan\":\"8.4.21\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.5.*\",\"lessThan\":\"8.5.6\",\"versionType\":\"semver\"}],\"defaultStatus\":\"affected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6722.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6722.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-416\",\"description\":\"CWE-416 Use After Free\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6722.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"subIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subAvailabilityImpact\":\"HIGH\",\"exploitMaturity\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"YES\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"MODERATE\",\"providerUrgency\":\"RED\",\"version\":\"4.0\",\"baseSeverity\":\"CRITICAL\",\"baseScore\":9.5,\"vectorString\":\"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/RE:M/U:Red\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/1/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6722.json", "sourcePath": "/containers/adp/1/metrics/1/cvssV3_1", "text": "{\"attackComplexity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"LOW\",\"baseScore\":7.7,\"baseSeverity\":\"HIGH\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-85c2-q967-79q5:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-85c2-q967-79q5", "sourcePath": "/description", "text": "ext-soap supports deduplicating objects in the XML graph through `id` and `href`. When traversing the XML graph, ext-soap will remember all plain PHP objects using the hash map `SOAP_GLOBAL(ref_map)`, where the pointer to the libxml2 node acts as a key, and the PHP object as a value. This happens in `soap_add_xml_ref()`.\r\n\r\nhttps://github.com/php/php-src/blob/dcf653339c245e25ea319248d0fc071a9405d688/ext/soap/php_encoding.c#L349-L354\r\n\r\nCrucially, the reference count of the PHP object is _not_ increased. Normally this is not a problem, as all objects in the XML graph are stored in the resulting object graph and cannot be freed.\r\n\r\n`soap_check_xml_ref()` does the opposite of `soap_add_xml_ref()`; it will check whether some libxml2 node as already been evaluated and stored in `SOAP_GLOBAL(ref_map)`.\r\n\r\nhttps://github.com/php/php-src/blob/dcf653339c245e25ea319248d0fc071a9405d688/ext/soap/php_encoding.c#L331-L347\r\n\r\nThe Apache map offers a mechanism to free objects between these two points by overwriting existing map entries.\r\n\r\n\r\n\r\nThis example will:\r\n\r\n- evaluate the `map` node\r\n- evaluate the `Stale` object, which includes calling calling `soap_add_xml_ref()` to remember it in `SOAP_GLOBAL(ref_map)`\r\n- add the resulting object to a temporary map, which will be the result of the Apache map node\r\n- overwrite the object immediately with `NULL` for the `` with an empty ``, releasing the `Stale` object only strongly referenced by the temporary map, with the reference in `SOAP_GLOBAL(ref_map)` becoming stale\r\n- have `` refer to this stale pointer within `SOAP_GLOBAL(ref_map)`, reusing the freed memory\r\n\r\nAfter this code, `$result` will refer to the stale memory where `Stale` was previously allocated. The attacker has high control over this memory segment by subsequently allocating plain strings, leading to Remote Code Execution.\r\n\r\nThe solution is straight forward, namely increase the reference count before adding objects to `SOAP_GLOBAL(ref_map)`, and configure a `ZVAL_PTR_DTOR` deallocator to release the objects when the procedure is done.", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-85c2-q967-79q5:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-85c2-q967-79q5", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-soap\"},\"vulnerable_version_range\":\"< 8.2.31\",\"patched_versions\":\"8.2.31\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-85c2-q967-79q5:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-85c2-q967-79q5", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-soap\"},\"vulnerable_version_range\":\"< 8.3.31\",\"patched_versions\":\"8.3.31\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-85c2-q967-79q5:/vulnerabilities/2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-85c2-q967-79q5", "sourcePath": "/vulnerabilities/2", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-soap\"},\"vulnerable_version_range\":\"< 8.4.21\",\"patched_versions\":\"8.4.21\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-85c2-q967-79q5:/vulnerabilities/3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-85c2-q967-79q5", "sourcePath": "/vulnerabilities/3", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-soap\"},\"vulnerable_version_range\":\"< 8.5.6\",\"patched_versions\":\"8.5.6\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2026-07-23T12:08:11.781Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-85c2-q967-79q5", "modifiedAt": "2026-05-07T12:56:25.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-07-23T12:08:11.781Z", "fetchedAt": "2026-10-23T02:43:50.025Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2026-05-07T12:56:25.000Z", "fetchedAt": "2026-10-22T22:18:00.744Z", "state": "published" } ], "sourceSummary": "PHPにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:23:49.030Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "970b3838255058277609c56136720e212c8a5e75bb1ebacb70596c698f8d0454", "sourceModifiedAt": "2026-07-23T12:08:11.781Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "PHP のバージョン 8.2.*（8.2.31 未満）、8.3.*（8.3.31 未満）、8.4.*（8.4.21 未満）、8.5.*（8.5.6 未満）において、SOAP 拡張のオブジェクト重複除去機構が PHP オブジェクトへのポインタを参照カウントを増やさずにグローバルマップに保存します。apache:Map ノードに重複キーがあると、2 番目のエントリの処理で最初のエントリが上書きされ、元の PHP オブジェクトが解放されますが、マップ内には古いポインタが残ります。その後、href 参照が解放されたノードを指すと、古いポインタが結果にコピーされます。PHP の文字列割り当てが解放されたメモリ領域を再利用できるため、攻撃者が SOAP リクエスト本文を操作できれば、この use‑after‑free を利用してサーバー上で任意のコードを実行できる可能性があります。", "risk": "攻撃者が SOAP リクエスト本文を操作できた場合、リモートコード実行が可能になる恐れがあります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "PHP 8.2.*（8.2.31 未満）の SOAP 拡張が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6722.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "PHP 8.3.*（8.3.31 未満）の SOAP 拡張が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6722.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "PHP 8.4.*（8.4.21 未満）の SOAP 拡張が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6722.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "PHP 8.5.*（8.5.6 未満）の SOAP 拡張が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6722.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "公式の対象表：PHP Group / PHP。影響ありとして記載：8.2系のうち、8.2.31未満。影響ありとして記載：8.3系のうち、8.3.31未満。影響ありとして記載：8.4系のうち、8.4.21未満。影響ありとして記載：8.5系のうち、8.5.6未満。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6722.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6722.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "PHP を 8.2.31、8.3.31、8.4.21、または 8.5.6 以上にアップデートして修正してください。", "kind": "fix", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5" ], "evidenceIds": [ "E4" ] }, { "text": "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php", "https://www.php.net/supported-versions.php", "https://documentation.ubuntu.com/security/security-updates/" ] } ], "temporaryMitigations": [ { "text": "自分でPHPの設定値を変更する前に、サーバー会社へ「このCVEに有効な回避策・副作用・修正予定」を確認してください。下の問い合わせ文を使えます。一般的なWAFやバックアップだけで修正済みとは扱わないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-6722", "https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6722.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6722.json", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-6722", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6722.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6722.json", "sourceField": "/containers/cna/title", "excerpt": "Use-After-Free in SOAP using Apache map", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6722.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"PHP Group\",\"product\":\"PHP\",\"packageName\":\"soap\",\"versions\":[{\"status\":\"affected\",\"version\":\"8.2.*\",\"lessThan\":\"8.2.31\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.3.*\",\"lessThan\":\"8.3.31\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.4.*\",\"lessThan\":\"8.4.21\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.5.*\",\"lessThan\":\"8.5.6\",\"versionType\":\"semver\"}],\"defaultStatus\":\"affected\"}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5", "sourceField": "/fixed", "excerpt": "[\"8.2.31\",\"8.3.31\",\"8.4.21\",\"8.5.6\"]", "language": null } ], "supportRequest": "件名：CVE-2026-6722（PHP）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・PHP 8.2.*（8.2.31 未満）の SOAP 拡張が影響を受けます。\n・PHP 8.3.*（8.3.31 未満）の SOAP 拡張が影響を受けます。\n・PHP 8.4.*（8.4.21 未満）の SOAP 拡張が影響を受けます。\n・PHP 8.5.*（8.5.6 未満）の SOAP 拡張が影響を受けます。\n・公式の対象表：PHP Group / PHP。影響ありとして記載：8.2系のうち、8.2.31未満。影響ありとして記載：8.3系のうち、8.3.31未満。影響ありとして記載：8.4系のうち、8.4.21未満。影響ありとして記載：8.5系のうち、8.5.6未満。個別に例外が記されていない版も、原資料では影響ありとされています。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-6722", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:23:49.030Z", "lastSuccess": "2026-10-23T03:23:49.030Z", "sourceCheckedAt": "2026-10-23T02:43:50.025Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-7258", "aliases": [ "GHSA-m8rr-4c36-8gq4" ], "title": "PHP：サービス停止", "summary": "PHP のバージョン 8.2.*（8.2.31 未満）、8.3.*（8.3.31 未満）、8.4.*（8.4.21 未満）、8.5.*（8.5.6 未満）において、urldecode() などの関数が符号付き char を ctype 系関数（例: isxdigit()）に渡します。NetBSD のように char がデフォルトで符号付きで、ctype がテーブル参照で最適化されているシステムでは、負のオフセットで配列にアクセスし、サービス拒否（denial of service）を引き起こす可能性があります。", "risk": "この問題により、サービス拒否（denial of service）が発生する可能性があります。", "product": "PHP", "category": "php", "component": "core", "severity": "medium", "cvss": 6.3, "cvssVersion": "4.0", "cvssSource": "php", "cvssVector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/U:Amber", "affected": [ { "product": "PHP", "range": "8.2.* / < 8.2.31（環境: NetBSD）" }, { "product": "PHP", "range": "8.3.* / < 8.3.31（環境: NetBSD）" }, { "product": "PHP", "range": "8.4.* / < 8.4.21（環境: NetBSD）" }, { "product": "PHP", "range": "8.5.* / < 8.5.6（環境: NetBSD）" }, { "product": "PHP", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。（環境: NetBSD）" } ], "fixed": [ "8.2.31", "8.3.31", "8.4.21", "8.5.6" ], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7258.json", "label": "CVE：php" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-7258", "label": "CVE公式レコード" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-m8rr-4c36-8gq4", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2026-05-07T12:56:13.000Z", "modifiedAt": "2026-05-11T13:06:10.908Z", "fetchedAt": "2026-10-23T02:43:50.238Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions, including urldecode(), pass signed char to ctype functions (like isxdigit()). On the systems with default signed char and optimized table-lookup ctype functions - such as NetBSD - this can lead to accessing array with negative offset, which can trigger a denial of service.", "sourceTitle": "Out-of-bounds read in urldecode() on NetBSD", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "PHP Group", "product": "PHP", "platforms": [ "NetBSD" ], "versions": [ { "status": "affected", "version": "8.2.*", "lessThan": "8.2.31", "versionType": "semver" }, { "status": "affected", "version": "8.3.*", "lessThan": "8.3.31", "versionType": "semver" }, { "status": "affected", "version": "8.4.*", "lessThan": "8.4.21", "versionType": "semver" }, { "status": "affected", "version": "8.5.*", "lessThan": "8.5.6", "versionType": "semver" } ], "defaultStatus": "affected" } ], "configurationNotes": "対象環境・機能: NetBSD。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-7258", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7258.json", "fetchedAt": "2026-10-23T02:43:50.238Z", "publishedAt": "2026-05-10T04:28:14.520Z", "modifiedAt": "2026-05-11T13:06:10.908Z", "state": "published", "provider": "php", "title": "Out-of-bounds read in urldecode() on NetBSD", "descriptions": [ { "lang": "en", "value": "In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions, including urldecode(), pass signed char to ctype functions (like isxdigit()). On the systems with default signed char and optimized table-lookup ctype functions - such as NetBSD - this can lead to accessing array with negative offset, which can trigger a denial of service.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Consider the following snippet within `php_url_decode_ex()` at `ext/standard/url.c`, called from PHPs `urldecode()` function:\r\n\r\nhttps://github.com/php/php-src/blob/dcf653339c245e25ea319248d0fc071a9405d688/ext/standard/url.c#L592-L593\r\n\r\nAccording to the C11 specification, `isxdigit()`'s (and all other `ctype.h` functions') only argument is of type `int`, and any value passed to it must be representable by `unsigned char`, i.e. 0-255.\r\n\r\n§7.4:\r\n\r\n> The header declares several functions useful for classifying and mapping characters. In all cases the argument is an int, the value of which shall be representable as an unsigned char or shall equal the value of the macro EOF. If the argument has any other value, the behavior is undefined.\r\n\r\nOn platforms where plain `char` is signed (which is most), passing a `char` with a value <0 to `int` (or casting to `int` explicitly as in this case) will lead to signed integer extension, leading to a negative `int` value. Instead, the `char` value should be cast to `unsigned char`, so that no sign extension occurs.\r\n\r\nMost platforms account for this common mistake. However, on NetBSD passing negative values to `isxdigit()` lead to an out-of-bounds read, leading to a segfault.", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-m8rr-4c36-8gq4" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "affected", "platforms": [ "NetBSD" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.2.*", "lessThan": "8.2.31", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.3.*", "lessThan": "8.3.31", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8.4.*", "lessThan": "8.4.21", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "8.5.*", "lessThan": "8.5.6", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package php-src; vulnerable range: < 8.2.31; patched versions: 8.2.31", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-m8rr-4c36-8gq4" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.3.31; patched versions: 8.3.31", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-m8rr-4c36-8gq4" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.4.21; patched versions: 8.4.21", "sourcePath": "/vulnerabilities/2/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-m8rr-4c36-8gq4" }, { "lang": "en", "value": "Package php-src; vulnerable range: < 8.5.6; patched versions: 8.5.6", "sourcePath": "/vulnerabilities/3/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-m8rr-4c36-8gq4" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-125", "lang": "en", "description": "CWE-125 Out-of-bounds Read", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/U:Amber", "baseScore": 6.3, "baseSeverity": "MEDIUM", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-m8rr-4c36-8gq4", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7258.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"PHP Group\",\"product\":\"PHP\",\"platforms\":[\"NetBSD\"],\"versions\":[{\"status\":\"affected\",\"version\":\"8.2.*\",\"lessThan\":\"8.2.31\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.3.*\",\"lessThan\":\"8.3.31\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.4.*\",\"lessThan\":\"8.4.21\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.5.*\",\"lessThan\":\"8.5.6\",\"versionType\":\"semver\"}],\"defaultStatus\":\"affected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7258.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions, including urldecode(), pass signed char to ctype functions (like isxdigit()). On the systems with default signed char and optimized table-lookup ctype functions - such as NetBSD - this can lead to accessing array with negative offset, which can trigger a denial of service.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7258.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-125\",\"description\":\"CWE-125 Out-of-bounds Read\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7258.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"LOW\",\"subAvailabilityImpact\":\"LOW\",\"exploitMaturity\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"AMBER\",\"version\":\"4.0\",\"baseSeverity\":\"MEDIUM\",\"baseScore\":6.3,\"vectorString\":\"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/U:Amber\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-m8rr-4c36-8gq4:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-m8rr-4c36-8gq4", "sourcePath": "/description", "text": "Consider the following snippet within `php_url_decode_ex()` at `ext/standard/url.c`, called from PHPs `urldecode()` function:\r\n\r\nhttps://github.com/php/php-src/blob/dcf653339c245e25ea319248d0fc071a9405d688/ext/standard/url.c#L592-L593\r\n\r\nAccording to the C11 specification, `isxdigit()`'s (and all other `ctype.h` functions') only argument is of type `int`, and any value passed to it must be representable by `unsigned char`, i.e. 0-255.\r\n\r\n§7.4:\r\n\r\n> The header declares several functions useful for classifying and mapping characters. In all cases the argument is an int, the value of which shall be representable as an unsigned char or shall equal the value of the macro EOF. If the argument has any other value, the behavior is undefined.\r\n\r\nOn platforms where plain `char` is signed (which is most), passing a `char` with a value <0 to `int` (or casting to `int` explicitly as in this case) will lead to signed integer extension, leading to a negative `int` value. Instead, the `char` value should be cast to `unsigned char`, so that no sign extension occurs.\r\n\r\nMost platforms account for this common mistake. However, on NetBSD passing negative values to `isxdigit()` lead to an out-of-bounds read, leading to a segfault.", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-m8rr-4c36-8gq4:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-m8rr-4c36-8gq4", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"php-src\"},\"vulnerable_version_range\":\"< 8.2.31\",\"patched_versions\":\"8.2.31\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-m8rr-4c36-8gq4:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-m8rr-4c36-8gq4", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"php-src\"},\"vulnerable_version_range\":\"< 8.3.31\",\"patched_versions\":\"8.3.31\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-m8rr-4c36-8gq4:/vulnerabilities/2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-m8rr-4c36-8gq4", "sourcePath": "/vulnerabilities/2", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"php-src\"},\"vulnerable_version_range\":\"< 8.4.21\",\"patched_versions\":\"8.4.21\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-m8rr-4c36-8gq4:/vulnerabilities/3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-m8rr-4c36-8gq4", "sourcePath": "/vulnerabilities/3", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"php-src\"},\"vulnerable_version_range\":\"< 8.5.6\",\"patched_versions\":\"8.5.6\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2026-05-11T13:06:10.908Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-m8rr-4c36-8gq4", "modifiedAt": "2026-05-07T12:56:13.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-05-11T13:06:10.908Z", "fetchedAt": "2026-10-23T02:43:50.238Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2026-05-07T12:56:13.000Z", "fetchedAt": "2026-10-22T22:18:00.744Z", "state": "published" } ], "sourceSummary": "PHPにサービス停止に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "処理の停止や過大な負荷により、サービスを利用できなくなる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:37:58.191Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "e28fbfed616f1e1f395f6d7c9e5d253a5897355e8315509b4c74952fbcab8e59", "sourceModifiedAt": "2026-05-11T13:06:10.908Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "PHP のバージョン 8.2.*（8.2.31 未満）、8.3.*（8.3.31 未満）、8.4.*（8.4.21 未満）、8.5.*（8.5.6 未満）において、urldecode() などの関数が符号付き char を ctype 系関数（例: isxdigit()）に渡します。NetBSD のように char がデフォルトで符号付きで、ctype がテーブル参照で最適化されているシステムでは、負のオフセットで配列にアクセスし、サービス拒否（denial of service）を引き起こす可能性があります。", "risk": "この問題により、サービス拒否（denial of service）が発生する可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "PHP 8.2.*（8.2.31 未満）が NetBSD 上で影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7258.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "PHP 8.3.*（8.3.31 未満）が NetBSD 上で影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7258.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "PHP 8.4.*（8.4.21 未満）が NetBSD 上で影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7258.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "PHP 8.5.*（8.5.6 未満）が NetBSD 上で影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7258.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "公式の対象表：PHP Group / PHP。影響ありとして記載：8.2系のうち、8.2.31未満。影響ありとして記載：8.3系のうち、8.3.31未満。影響ありとして記載：8.4系のうち、8.4.21未満。影響ありとして記載：8.5系のうち、8.5.6未満。対象の環境：NetBSD。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7258.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7258.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7258.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "自分でPHPの設定値を変更する前に、サーバー会社へ「このCVEに有効な回避策・副作用・修正予定」を確認してください。下の問い合わせ文を使えます。一般的なWAFやバックアップだけで修正済みとは扱わないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-7258", "https://github.com/php/php-src/security/advisories/GHSA-m8rr-4c36-8gq4" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7258.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7258.json", "label": "CVE：php" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-7258", "label": "CVE公式レコード" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-m8rr-4c36-8gq4", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7258.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions, including urldecode(), pass signed char to ctype functions (like isxdigit()). On the systems with default signed char and optimized table-lookup ctype functions - such as NetBSD - this can lead to accessing array with negative offset, which can trigger a denial of service.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7258.json", "sourceField": "/containers/cna/title", "excerpt": "Out-of-bounds read in urldecode() on NetBSD", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7258.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"PHP Group\",\"product\":\"PHP\",\"platforms\":[\"NetBSD\"],\"versions\":[{\"status\":\"affected\",\"version\":\"8.2.*\",\"lessThan\":\"8.2.31\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.3.*\",\"lessThan\":\"8.3.31\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.4.*\",\"lessThan\":\"8.4.21\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.5.*\",\"lessThan\":\"8.5.6\",\"versionType\":\"semver\"}],\"defaultStatus\":\"affected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-7258（PHP）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・PHP 8.2.*（8.2.31 未満）が NetBSD 上で影響を受けます。\n・PHP 8.3.*（8.3.31 未満）が NetBSD 上で影響を受けます。\n・PHP 8.4.*（8.4.21 未満）が NetBSD 上で影響を受けます。\n・PHP 8.5.*（8.5.6 未満）が NetBSD 上で影響を受けます。\n・公式の対象表：PHP Group / PHP。影響ありとして記載：8.2系のうち、8.2.31未満。影響ありとして記載：8.3系のうち、8.3.31未満。影響ありとして記載：8.4系のうち、8.4.21未満。影響ありとして記載：8.5系のうち、8.5.6未満。対象の環境：NetBSD。個別に例外が記されていない版も、原資料では影響ありとされています。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-7258", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:37:58.191Z", "lastSuccess": "2026-10-23T03:37:58.191Z", "sourceCheckedAt": "2026-10-23T02:43:50.238Z", "errorCode": null }, "glossary": [ { "term": "サービス拒否（DoS）", "meaning": "サービスや機能が停止したり、処理が遅くなったりして、通常どおり利用できなくなることです。", "sourceUrl": "https://cwe.mitre.org/data/definitions/400.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-6104", "aliases": [ "GHSA-74r9-qxhc-fx53" ], "title": "PHP：情報の漏えい", "summary": "PHP 8.4 系（8.4.21 未満）および 8.5 系（8.5.6 未満）で、エンコーディング名に埋め込み NUL バイトが含まれる状態で mb_convert_encoding() や同系の mbstring 関数に渡すと、strncasecmp() が 0 を返したことを「文字列の長さが同じ」と誤って判断します。その結果、グローバルメモリの範囲外を読み取ることになり、クラッシュや情報漏洩が起こる可能性があります。影響を受ける関数は mb_convert_encoding()、mb_detect_encoding()、mb_convert_variables()、mb_detect_order()、および mbstring.detect_order と mbstring.http_output の INI 設定です。", "risk": "メモリの範囲外読み取りにより、サーバーがクラッシュしたり、隣接するデータが漏洩したりする可能性があります。", "product": "PHP", "category": "php", "component": "core", "severity": "medium", "cvss": 6.3, "cvssVersion": "4.0", "cvssSource": "php", "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:L/SI:N/SA:L/RE:M/U:Amber", "affected": [ { "product": "PHP", "range": "8.4.* / < 8.4.21" }, { "product": "PHP", "range": "8.5.* / < 8.5.6" } ], "fixed": [ "8.4.21", "8.5.6" ], "steps": [ "PHP を 8.4.21 以上、または 8.5.6 以上にアップデートしてください。", "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6104.json", "label": "CVE：php" }, { "url": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-74r9-qxhc-fx53", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-74r9-qxhc-fx53", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-6104", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2026-05-07T12:55:25.000Z", "modifiedAt": "2026-07-15T00:41:42.455Z", "fetchedAt": "2026-10-23T02:43:49.820Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure or crash. Affected functions include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order(), as well as the mbstring.detect_order and mbstring.http_output INI settings.", "sourceTitle": "Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "PHP Group", "product": "PHP", "packageName": "mbstring", "versions": [ { "status": "affected", "version": "8.4.*", "lessThan": "8.4.21", "versionType": "semver" }, { "status": "affected", "version": "8.5.*", "lessThan": "8.5.6", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-6104", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6104.json", "fetchedAt": "2026-10-23T02:43:49.820Z", "publishedAt": "2026-05-10T04:35:17.328Z", "modifiedAt": "2026-07-15T00:41:42.455Z", "state": "published", "provider": "php", "title": "Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding", "descriptions": [ { "lang": "en", "value": "In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure or crash. Affected functions include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order(), as well as the mbstring.detect_order and mbstring.http_output INI settings.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "## Summary\r\n\r\nA global buffer over-read exists in `mbfl_name2encoding_ex()` (`ext/mbstring/libmbfl/mbfl/mbfl_encoding.c`, line 352), called from `mb_convert_encoding(...)` and other mbstring functions, when parsing encoding names with embedded NUL bytes.\n\n## Root Cause\r\n\r\nIn `mbfl_name2encoding_ex`, the MIME name search loop (line 352) uses:\r\n\r\n\r\n\r\nWhen `name` contains an embedded NUL byte (e.g., `\"UTF-8\\x00AAAA...\"`), `strncasecmp` returns 0 after matching up to the NUL (since both strings have NUL at the same position). The subsequent check `(*encoding)->mime_name[name_len]` then reads at offset `name_len` (e.g., 22) from `mime_name`, which is only 6 bytes long (`\"UTF-8\\0\"`). This reads 16+ bytes past the end of the global string into adjacent global memory.\r\n\r\nThe same issue exists on lines 362 for encoding aliases.\n\n## Minimal Reproducer\r\n\r\n\r\n\r\nRunning with ASan-instrumented PHP 8.4.20:\n\n## Attack Surface\r\n\r\n- Triggerable when a attacker-controlled encoding is passed to `mb_convert_encoding()` without sanitization\r\n- Also affected are `mb_detect_encoding()`, `mb_convert_variables()`, `mb_detect_order()`, as well as the `mbstring.detect_order` and `mbstring.http_output` INI settings.\r\n- Out-of-bounds read of global memory (CWE-125)\r\n- Information disclosure of adjacent global data; not directly exploitable for code execution\n\n## Environment\r\n\r\n- PHP 8.4.0+, `-fsanitize=address,undefined`", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-74r9-qxhc-fx53" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "packageName": "mbstring", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.4.*", "lessThan": "8.4.21", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.5.*", "lessThan": "8.5.6", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package ext-mbstring; vulnerable range: < 8.4.21; patched versions: 8.4.21", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-74r9-qxhc-fx53" }, { "lang": "en", "value": "Package ext-mbstring; vulnerable range: < 8.5.6; patched versions: 8.5.6", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-74r9-qxhc-fx53" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-125", "lang": "en", "description": "CWE-125 Out-of-bounds Read", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:L/SI:N/SA:L/RE:M/U:Amber", "baseScore": 6.3, "baseSeverity": "MEDIUM", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" }, { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "baseScore": 8.2, "baseSeverity": "HIGH", "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/metrics/1/cvssV3_1" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-74r9-qxhc-fx53", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-6104", "label": "redhat-SADP", "tags": [ "vdb-entry", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468573", "label": "RHBZ#2468573", "tags": [ "issue-tracking", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/1" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6104.json", "label": "redhat-SADP", "tags": [ "x_sadp-csaf-vex" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/2" }, { "url": "https://access.redhat.com/errata/RHSA-2026:22649", "label": "redhat-SADP", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/3" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6104.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"PHP Group\",\"product\":\"PHP\",\"packageName\":\"mbstring\",\"versions\":[{\"status\":\"affected\",\"version\":\"8.4.*\",\"lessThan\":\"8.4.21\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.5.*\",\"lessThan\":\"8.5.6\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6104.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure or crash. Affected functions include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order(), as well as the mbstring.detect_order and mbstring.http_output INI settings.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6104.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-125\",\"description\":\"CWE-125 Out-of-bounds Read\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6104.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"LOW\",\"subConfidentialityImpact\":\"LOW\",\"vulnIntegrityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"LOW\",\"subAvailabilityImpact\":\"LOW\",\"exploitMaturity\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"MODERATE\",\"providerUrgency\":\"AMBER\",\"version\":\"4.0\",\"baseSeverity\":\"MEDIUM\",\"baseScore\":6.3,\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:L/SI:N/SA:L/RE:M/U:Amber\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/1/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6104.json", "sourcePath": "/containers/adp/1/metrics/1/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-74r9-qxhc-fx53:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-74r9-qxhc-fx53", "sourcePath": "/description", "text": "## Summary\r\n\r\nA global buffer over-read exists in `mbfl_name2encoding_ex()` (`ext/mbstring/libmbfl/mbfl/mbfl_encoding.c`, line 352), called from `mb_convert_encoding(...)` and other mbstring functions, when parsing encoding names with embedded NUL bytes.\n\n## Root Cause\r\n\r\nIn `mbfl_name2encoding_ex`, the MIME name search loop (line 352) uses:\r\n\r\n\r\n\r\nWhen `name` contains an embedded NUL byte (e.g., `\"UTF-8\\x00AAAA...\"`), `strncasecmp` returns 0 after matching up to the NUL (since both strings have NUL at the same position). The subsequent check `(*encoding)->mime_name[name_len]` then reads at offset `name_len` (e.g., 22) from `mime_name`, which is only 6 bytes long (`\"UTF-8\\0\"`). This reads 16+ bytes past the end of the global string into adjacent global memory.\r\n\r\nThe same issue exists on lines 362 for encoding aliases.\n\n## Minimal Reproducer\r\n\r\n\r\n\r\nRunning with ASan-instrumented PHP 8.4.20:\n\n## Attack Surface\r\n\r\n- Triggerable when a attacker-controlled encoding is passed to `mb_convert_encoding()` without sanitization\r\n- Also affected are `mb_detect_encoding()`, `mb_convert_variables()`, `mb_detect_order()`, as well as the `mbstring.detect_order` and `mbstring.http_output` INI settings.\r\n- Out-of-bounds read of global memory (CWE-125)\r\n- Information disclosure of adjacent global data; not directly exploitable for code execution\n\n## Environment\r\n\r\n- PHP 8.4.0+, `-fsanitize=address,undefined`", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-74r9-qxhc-fx53:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-74r9-qxhc-fx53", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-mbstring\"},\"vulnerable_version_range\":\"< 8.4.21\",\"patched_versions\":\"8.4.21\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-74r9-qxhc-fx53:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-74r9-qxhc-fx53", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-mbstring\"},\"vulnerable_version_range\":\"< 8.5.6\",\"patched_versions\":\"8.5.6\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2026-07-15T00:41:42.455Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-74r9-qxhc-fx53", "modifiedAt": "2026-05-07T12:55:25.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-07-15T00:41:42.455Z", "fetchedAt": "2026-10-23T02:43:49.820Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2026-05-07T12:55:25.000Z", "fetchedAt": "2026-10-22T22:18:00.744Z", "state": "published" } ], "sourceSummary": "PHPに情報の漏えいに関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来公開しない情報を読み取られる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:23:49.548Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "a2086ecbe60e643199b6451c664aa49846d8d7b2128b203a1dffdd8b4027c30a", "sourceModifiedAt": "2026-07-15T00:41:42.455Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "PHP 8.4 系（8.4.21 未満）および 8.5 系（8.5.6 未満）で、エンコーディング名に埋め込み NUL バイトが含まれる状態で mb_convert_encoding() や同系の mbstring 関数に渡すと、strncasecmp() が 0 を返したことを「文字列の長さが同じ」と誤って判断します。その結果、グローバルメモリの範囲外を読み取ることになり、クラッシュや情報漏洩が起こる可能性があります。影響を受ける関数は mb_convert_encoding()、mb_detect_encoding()、mb_convert_variables()、mb_detect_order()、および mbstring.detect_order と mbstring.http_output の INI 設定です。", "risk": "メモリの範囲外読み取りにより、サーバーがクラッシュしたり、隣接するデータが漏洩したりする可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1", "E3" ], "applicability": [ { "text": "PHP 8.4 系のバージョン 8.4.21 未満が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6104.json", "https://api.github.com/repos/php/php-src/security-advisories/GHSA-74r9-qxhc-fx53" ], "evidenceIds": [ "E4", "E5", "E2" ] }, { "text": "PHP 8.5 系のバージョン 8.5.6 未満が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6104.json", "https://api.github.com/repos/php/php-src/security-advisories/GHSA-74r9-qxhc-fx53" ], "evidenceIds": [ "E4", "E6", "E2" ] }, { "text": "影響を受ける関数は mb_convert_encoding()、mb_detect_encoding()、mb_convert_variables()、mb_detect_order() です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6104.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "mbstring.detect_order と mbstring.http_output の INI 設定も影響対象です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6104.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：PHP Group / PHP。影響ありとして記載：8.4系のうち、8.4.21未満。影響ありとして記載：8.5系のうち、8.5.6未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6104.json" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6104.json" ], "evidenceIds": [ "E4" ] }, { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "PHP を 8.4.21 以上、または 8.5.6 以上にアップデートしてください。", "kind": "fix", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-74r9-qxhc-fx53" ], "evidenceIds": [ "E7" ] }, { "text": "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php", "https://www.php.net/supported-versions.php", "https://documentation.ubuntu.com/security/security-updates/" ] } ], "temporaryMitigations": [ { "text": "自分でPHPの設定値を変更する前に、サーバー会社へ「このCVEに有効な回避策・副作用・修正予定」を確認してください。下の問い合わせ文を使えます。一般的なWAFやバックアップだけで修正済みとは扱わないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-6104", "https://github.com/php/php-src/security/advisories/GHSA-74r9-qxhc-fx53" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6104.json" ], "evidenceIds": [ "E4" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6104.json", "label": "CVE：php" }, { "url": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-74r9-qxhc-fx53", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-74r9-qxhc-fx53", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-6104", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6104.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure or crash. Affected functions include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order(), as well as the mbstring.detect_order and mbstring.http_output INI settings.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6104.json", "sourceField": "/containers/cna/title", "excerpt": "Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding", "language": null }, { "id": "E3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-74r9-qxhc-fx53", "sourceField": "/description", "excerpt": "## Summary\r\n\r\nA global buffer over-read exists in `mbfl_name2encoding_ex()` (`ext/mbstring/libmbfl/mbfl/mbfl_encoding.c`, line 352), called from `mb_convert_encoding(...)` and other mbstring functions, when parsing encoding names with embedded NUL bytes.\n\n## Root Cause\r\n\r\nIn `mbfl_name2encoding_ex`, the MIME name search loop (line 352) uses:\r\n\r\n\r\n\r\nWhen `name` contains an embedded NUL byte (e.g., `\"UTF-8\\x00AAAA...\"`), `strncasecmp` returns 0 after matching up to the NUL (since both strings have NUL at the same position). The subsequent check `(*encoding)->mime_name[name_len]` then reads at offset `name_len` (e.g., 22) from `mime_name`, which is only 6 bytes long (`\"UTF-8\\0\"`). This reads 16+ bytes past the end of the global string into adjacent global memory.\r\n\r\nThe same issue exists on lines 362 for encoding aliases.\n\n## Minimal Reproducer\r\n\r\n\r\n\r\nRunning with ASan-instrumented PHP 8.4.20:\n\n## Attack Surface\r\n\r\n- Triggerable when a attacker-controlled encoding is passed to `mb_convert_encoding()` without sanitization\r\n- Also affected are `mb_detect_encoding()`, `mb_convert_variables()`, `mb_detect_order()`, as well as the `mbstring.detect_order` and `mbstring.http_output` INI settings.\r\n- Out-of-bounds read of global memory (CWE-125)\r\n- Information disclosure of adjacent global data; not directly exploitable for code execution\n\n## Environment\r\n\r\n- PHP 8.4.0+, `-fsanitize=address,undefined`", "language": "en", "representation": "defensive_sections", "filtered": true }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6104.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"PHP Group\",\"product\":\"PHP\",\"packageName\":\"mbstring\",\"versions\":[{\"status\":\"affected\",\"version\":\"8.4.*\",\"lessThan\":\"8.4.21\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.5.*\",\"lessThan\":\"8.5.6\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-74r9-qxhc-fx53", "sourceField": "/vulnerabilities/0", "excerpt": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-mbstring\"},\"vulnerable_version_range\":\"< 8.4.21\",\"patched_versions\":\"8.4.21\",\"vulnerable_functions\":[]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-74r9-qxhc-fx53", "sourceField": "/vulnerabilities/1", "excerpt": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-mbstring\"},\"vulnerable_version_range\":\"< 8.5.6\",\"patched_versions\":\"8.5.6\",\"vulnerable_functions\":[]}", "language": null, "representation": "source_json" }, { "id": "E7", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-74r9-qxhc-fx53", "sourceField": "/fixed", "excerpt": "[\"8.4.21\",\"8.5.6\"]", "language": null } ], "supportRequest": "件名：CVE-2026-6104（PHP）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・PHP 8.4 系のバージョン 8.4.21 未満が影響を受けます。\n・PHP 8.5 系のバージョン 8.5.6 未満が影響を受けます。\n・影響を受ける関数は mb_convert_encoding()、mb_detect_encoding()、mb_convert_variables()、mb_detect_order() です。\n・mbstring.detect_order と mbstring.http_output の INI 設定も影響対象です。\n・公式の対象表：PHP Group / PHP。影響ありとして記載：8.4系のうち、8.4.21未満。影響ありとして記載：8.5系のうち、8.5.6未満。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-6104", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:23:49.548Z", "lastSuccess": "2026-10-23T03:23:49.548Z", "sourceCheckedAt": "2026-10-23T02:43:49.820Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2025-14179", "aliases": [ "GHSA-w476-322c-wpvm" ], "title": "PHP：Firebird接続で、利用者の入力が不正なデータベース命令になるおそれ", "summary": "PHPからFirebirdデータベースへ接続する機能が確認対象です。アプリが利用者の入力をPDO::quote()で加工してSQL文に組み込む場合でも、特殊な文字を含む入力で意図しないデータベース命令になる可能性があります。Firebirdを使っているかを開発担当者に確認し、サーバーのPHPを更新してください。", "risk": "攻撃者が決めた入力が、アプリの意図しないSQL命令として扱われる可能性があります。PHPが使うデータベースの権限で何ができるかは、アプリの設定によって異なります。", "product": "PHP", "category": "php", "component": "core", "severity": "high", "cvss": 7.4, "cvssVersion": "4.0", "cvssSource": "php", "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/AU:Y/RE:M/U:Amber", "affected": [ { "product": "PHP 8.2系", "range": "< 8.2.31" }, { "product": "PHP 8.3系", "range": "< 8.3.31" }, { "product": "PHP 8.4系", "range": "< 8.4.21" }, { "product": "PHP 8.5系", "range": "< 8.5.6" } ], "fixed": [ "8.2.31", "8.3.31", "8.4.21", "8.5.6" ], "steps": [ "使っている系列に合わせて、PHP 8.2系は8.2.31、8.3系は8.3.31、8.4系は8.4.21、8.5系は8.5.6、またはこの修正を含む後続版へ更新します。PHPのサーバー管理者へCVE-2025-14179を指定して依頼してください。", "更新後、Firebirdを使う検索・登録・変更などの通常の操作を開発担当者に確認してもらいます。利用者の入力を処理する実装も合わせて見直してください。", "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14179.json", "label": "CVE公式：対象系列と成立条件" }, { "url": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-w476-322c-wpvm", "label": "確認した公式の原資料" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-14179", "label": "CVE公式レコード" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm", "label": "PHP開発元：PDO Firebirdの問題・修正版" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2026-05-07T12:55:05.000Z", "modifiedAt": "2026-07-15T01:27:20.859Z", "fetchedAt": "2026-10-23T02:43:35.402Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.", "sourceTitle": "SQL injection in pdo_firebird via NUL bytes in quoted strings", "summaryMethod": "公式資料を照合した個別の日本語解説。一般的な操作手順は別に区別しています。", "state": "published", "affectedDetails": [ { "vendor": "PHP Group", "product": "PHP", "packageName": "pdo_firebird", "versions": [ { "status": "affected", "version": "8.2.*", "lessThan": "8.2.31", "versionType": "semver" }, { "status": "affected", "version": "8.3.*", "lessThan": "8.3.31", "versionType": "semver" }, { "status": "affected", "version": "8.4.*", "lessThan": "8.4.21", "versionType": "semver" }, { "status": "affected", "version": "8.5.*", "lessThan": "8.5.6", "versionType": "semver" } ], "defaultStatus": "affected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-14179", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14179.json", "fetchedAt": "2026-10-23T02:43:35.402Z", "publishedAt": "2026-05-10T03:51:14.596Z", "modifiedAt": "2026-07-15T01:27:20.859Z", "state": "published", "provider": "php", "title": "SQL injection in pdo_firebird via NUL bytes in quoted strings", "descriptions": [ { "lang": "en", "value": "In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "Improper handling of NUL bytes during the preparation of Firebird SQL queries leads to sections of the of the query being dropped. NUL bytes can find their way into queries even under regular circumstances via `PDO::quote()`.\r\n\r\nhttps://github.com/php/php-src/blob/046ffa257581d6f1a709e9fbc4638793c2ac7e22/ext/pdo_firebird/firebird_driver.c#L437-L442\r\n\r\nA new query is constructed token-by-token. In the case of a `ttString` `'\\0'`, the string is copied via `strncat()` rather than `memcpy()`, stopping after the first `'` quote and ignoring both the `\\0` and terminating `'` quote. This will incorrectly embed the SQL tokens following the string into the string, allowing for trivial SQL injection if the next string is also attacker-controlled.\r\n\r\n\r\n\r\nThis incorrect preparation applies to `SELECT`, `INSERT`, `UPDATE`, `DELETE`, `MERGE`, `WITH` and `EXECUTE` statements.\n\n## Credits\r\nAleksey Solovev, Nikita Sveshnikov (Positive Technologies)", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-w476-322c-wpvm" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "packageName": "pdo_firebird", "defaultStatus": "affected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.2.*", "lessThan": "8.2.31", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.3.*", "lessThan": "8.3.31", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8.4.*", "lessThan": "8.4.21", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "8.5.*", "lessThan": "8.5.6", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package ext-pdo_firebird; vulnerable range: < 8.2.31; patched versions: 8.2.31", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-w476-322c-wpvm" }, { "lang": "en", "value": "Package ext-pdo_firebird; vulnerable range: < 8.3.31; patched versions: 8.3.31", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-w476-322c-wpvm" }, { "lang": "en", "value": "Package ext-pdo_firebird; vulnerable range: < 8.4.21; patched versions: 8.4.21", "sourcePath": "/vulnerabilities/2/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-w476-322c-wpvm" }, { "lang": "en", "value": "Package ext-pdo_firebird; vulnerable range: < 8.5.6; patched versions: 8.5.6", "sourcePath": "/vulnerabilities/3/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-w476-322c-wpvm" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-89", "lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/AU:Y/RE:M/U:Amber", "baseScore": 7.4, "baseSeverity": "HIGH", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" }, { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH", "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/metrics/1/cvssV3_1" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-14179", "label": "redhat-SADP", "tags": [ "vdb-entry", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468567", "label": "RHBZ#2468567", "tags": [ "issue-tracking", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/1" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14179.json", "label": "redhat-SADP", "tags": [ "x_sadp-csaf-vex" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/2" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14179.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"PHP Group\",\"product\":\"PHP\",\"packageName\":\"pdo_firebird\",\"versions\":[{\"status\":\"affected\",\"version\":\"8.2.*\",\"lessThan\":\"8.2.31\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.3.*\",\"lessThan\":\"8.3.31\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.4.*\",\"lessThan\":\"8.4.21\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.5.*\",\"lessThan\":\"8.5.6\",\"versionType\":\"semver\"}],\"defaultStatus\":\"affected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14179.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14179.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-89\",\"description\":\"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14179.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"ACTIVE\",\"vulnConfidentialityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"subIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subAvailabilityImpact\":\"HIGH\",\"exploitMaturity\":\"PROOF_OF_CONCEPT\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"YES\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"MODERATE\",\"providerUrgency\":\"AMBER\",\"version\":\"4.0\",\"baseSeverity\":\"HIGH\",\"baseScore\":7.4,\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/AU:Y/RE:M/U:Amber\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/1/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14179.json", "sourcePath": "/containers/adp/1/metrics/1/cvssV3_1", "text": "{\"attackComplexity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-w476-322c-wpvm:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-w476-322c-wpvm", "sourcePath": "/description", "text": "Improper handling of NUL bytes during the preparation of Firebird SQL queries leads to sections of the of the query being dropped. NUL bytes can find their way into queries even under regular circumstances via `PDO::quote()`.\r\n\r\nhttps://github.com/php/php-src/blob/046ffa257581d6f1a709e9fbc4638793c2ac7e22/ext/pdo_firebird/firebird_driver.c#L437-L442\r\n\r\nA new query is constructed token-by-token. In the case of a `ttString` `'\\0'`, the string is copied via `strncat()` rather than `memcpy()`, stopping after the first `'` quote and ignoring both the `\\0` and terminating `'` quote. This will incorrectly embed the SQL tokens following the string into the string, allowing for trivial SQL injection if the next string is also attacker-controlled.\r\n\r\n\r\n\r\nThis incorrect preparation applies to `SELECT`, `INSERT`, `UPDATE`, `DELETE`, `MERGE`, `WITH` and `EXECUTE` statements.\n\n## Credits\r\nAleksey Solovev, Nikita Sveshnikov (Positive Technologies)", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-w476-322c-wpvm:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-w476-322c-wpvm", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-pdo_firebird\"},\"vulnerable_version_range\":\"< 8.2.31\",\"patched_versions\":\"8.2.31\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-w476-322c-wpvm:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-w476-322c-wpvm", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-pdo_firebird\"},\"vulnerable_version_range\":\"< 8.3.31\",\"patched_versions\":\"8.3.31\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-w476-322c-wpvm:/vulnerabilities/2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-w476-322c-wpvm", "sourcePath": "/vulnerabilities/2", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-pdo_firebird\"},\"vulnerable_version_range\":\"< 8.4.21\",\"patched_versions\":\"8.4.21\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-w476-322c-wpvm:/vulnerabilities/3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-w476-322c-wpvm", "sourcePath": "/vulnerabilities/3", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-pdo_firebird\"},\"vulnerable_version_range\":\"< 8.5.6\",\"patched_versions\":\"8.5.6\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2026-07-15T01:27:20.859Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-w476-322c-wpvm", "modifiedAt": "2026-05-07T12:55:06.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-07-15T01:27:20.859Z", "fetchedAt": "2026-10-23T02:43:35.402Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2026-05-07T12:55:06.000Z", "fetchedAt": "2026-10-22T22:18:00.744Z", "state": "published" } ], "sourceSummary": "PHPにデータベースへの不正操作に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "データベースに不正な命令を送られ、情報の閲覧や変更につながる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "reviewed", "reviewedAt": "2026-10-23T03:34:23.000Z", "reviewState": "current", "summary": "PHPからFirebirdデータベースへ接続する機能が確認対象です。アプリが利用者の入力をPDO::quote()で加工してSQL文に組み込む場合でも、特殊な文字を含む入力で意図しないデータベース命令になる可能性があります。Firebirdを使っているかを開発担当者に確認し、サーバーのPHPを更新してください。", "risk": "攻撃者が決めた入力が、アプリの意図しないSQL命令として扱われる可能性があります。PHPが使うデータベースの権限で何ができるかは、アプリの設定によって異なります。", "applicability": [ { "text": "対象はPHPのPDO Firebirdドライバー（pdo_firebird）です。PHP 8.2系の8.2.31未満、8.3系の8.3.31未満、8.4系の8.4.21未満、8.5系の8.5.6未満が公式に挙がっています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14179.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "利用者が決めた値を、アプリ側がPDO::quote()で加工してSQL文に埋め込む処理が関係します。攻撃者自身がサーバーでPDO::quote()を呼び出せる必要がある、という意味ではありません。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14179.json", "https://api.github.com/repos/php/php-src/security-advisories/GHSA-w476-322c-wpvm" ], "evidenceIds": [ "E1", "E3" ] }, { "text": "開発担当者へ、Firebird接続とpdo_firebirdを使い、NUL（見えない制御文字）を含む値をSQL文に組み込み、その後の文字列にも利用者が決めた値を使う処理があるかを確認します。WordPressやPHPを使っているという情報だけで、この条件に当てはまるとは決められません。", "kind": "check", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14179.json", "https://api.github.com/repos/php/php-src/security-advisories/GHSA-w476-322c-wpvm" ], "evidenceIds": [ "E1", "E3" ] }, { "text": "最初に「PHP」を使っているか、開発元・製品名・バージョンを確認します。同じカテゴリの製品を使っているだけでは、この問題の対象とは限りません。", "kind": "check", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-14179", "https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm" ] } ], "versionChecks": [ { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "使っている系列に合わせて、PHP 8.2系は8.2.31、8.3系は8.3.31、8.4系は8.4.21、8.5系は8.5.6、またはこの修正を含む後続版へ更新します。PHPのサーバー管理者へCVE-2025-14179を指定して依頼してください。", "kind": "fix", "sourceUrls": [ "https://api.github.com/repos/php/php-src/security-advisories/GHSA-w476-322c-wpvm" ], "evidenceIds": [ "E4", "E5", "E6", "E7" ] }, { "text": "更新後、Firebirdを使う検索・登録・変更などの通常の操作を開発担当者に確認してもらいます。利用者の入力を処理する実装も合わせて見直してください。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm" ] }, { "text": "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php", "https://www.php.net/supported-versions.php", "https://documentation.ubuntu.com/security/security-updates/" ] } ], "temporaryMitigations": [], "verification": [ { "text": "更新後に製品情報の画面で版・ビルド番号を記録し、このCVEの修正が含まれることを提供元の説明と照合します。普段の主要な操作も確認し、担当者から適用日時と結果を受け取ってください。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "利用中の環境を検査した結果ではありません。製品名・版・利用条件と、実際に修正が適用されているかを確認してください。", "一覧にない古いPHPの版を、対象外とは判断しません。利用しているOS・配布元の修正提供状況も確認してください。" ], "supportRequest": "件名：CVE-2025-14179（PHP）の影響と対応状況の確認\n\n利用中のサイト・機器・サービス：[記入してください]\n製品名・開発元：[記入してください]\n現在のバージョン・ビルド番号：[不明なら「不明」と記入]\n\nCVE-2025-14179について、次を教えてください。\n1. この環境は対象ですか。対象外の場合は、版・設定・機能などの判断理由を教えてください。\n2. 対象の場合、修正を含む版・パッケージ番号と、更新方法を教えてください。古い版に修正を取り込んでいる場合は、このCVEへの対応状況を教えてください。\n3. いつ対応できますか。再起動・停止時間・事前のバックアップや確認作業は必要ですか。\n4. すぐ更新できない場合、正式な回避策とその限界・副作用を教えてください。利用を続けてよい条件も知りたいです。\n5. 対応完了後、修正を確認できる版・設定・対応日時を連絡してください。\n\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-14179", "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14179.json", "label": "CVE公式：対象系列と成立条件" }, { "url": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-w476-322c-wpvm", "label": "確認した公式の原資料" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-14179", "label": "CVE公式レコード" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm", "label": "PHP開発元：PDO Firebirdの問題・修正版" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "reviewedSourceFingerprint": "reviewed-source-v1:b77e81a30e38041ccd63183f59379ee0b568b2f7674acd89b8a344053a009a61", "reviewedSourceScope": "official_evidence", "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14179.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14179.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"PHP Group\",\"product\":\"PHP\",\"packageName\":\"pdo_firebird\",\"versions\":[{\"status\":\"affected\",\"version\":\"8.2.*\",\"lessThan\":\"8.2.31\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.3.*\",\"lessThan\":\"8.3.31\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.4.*\",\"lessThan\":\"8.4.21\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.5.*\",\"lessThan\":\"8.5.6\",\"versionType\":\"semver\"}],\"defaultStatus\":\"affected\"}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-w476-322c-wpvm", "sourceField": "/description", "excerpt": "Improper handling of NUL bytes during the preparation of Firebird SQL queries leads to sections of the of the query being dropped. NUL bytes can find their way into queries even under regular circumstances via `PDO::quote()`.\r\n\r\nhttps://github.com/php/php-src/blob/046ffa257581d6f1a709e9fbc4638793c2ac7e22/ext/pdo_firebird/firebird_driver.c#L437-L442\r\n\r\nA new query is constructed token-by-token. In the case of a `ttString` `'\\0'`, the string is copied via `strncat()` rather than `memcpy()`, stopping after the first `'` quote and ignoring both the `\\0` and terminating `'` quote. This will incorrectly embed the SQL tokens following the string into the string, allowing for trivial SQL injection if the next string is also attacker-controlled.\r\n\r\n\r\n\r\nThis incorrect preparation applies to `SELECT`, `INSERT`, `UPDATE`, `DELETE`, `MERGE`, `WITH` and `EXECUTE` statements.\n\n## Credits\r\nAleksey Solovev, Nikita Sveshnikov (Positive Technologies)", "language": "en", "representation": "defensive_sections" }, { "id": "E4", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-w476-322c-wpvm", "sourceField": "/vulnerabilities/0", "excerpt": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-pdo_firebird\"},\"vulnerable_version_range\":\"< 8.2.31\",\"patched_versions\":\"8.2.31\",\"vulnerable_functions\":[]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-w476-322c-wpvm", "sourceField": "/vulnerabilities/1", "excerpt": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-pdo_firebird\"},\"vulnerable_version_range\":\"< 8.3.31\",\"patched_versions\":\"8.3.31\",\"vulnerable_functions\":[]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-w476-322c-wpvm", "sourceField": "/vulnerabilities/2", "excerpt": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-pdo_firebird\"},\"vulnerable_version_range\":\"< 8.4.21\",\"patched_versions\":\"8.4.21\",\"vulnerable_functions\":[]}", "language": null, "representation": "source_json" }, { "id": "E7", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-w476-322c-wpvm", "sourceField": "/vulnerabilities/3", "excerpt": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-pdo_firebird\"},\"vulnerable_version_range\":\"< 8.5.6\",\"patched_versions\":\"8.5.6\",\"vulnerable_functions\":[]}", "language": null, "representation": "source_json" } ], "summaryEvidenceIds": [ "E1", "E3" ], "riskEvidenceIds": [ "E1", "E3" ], "glossary": [ { "term": "SQLインジェクション", "meaning": "入力した値がデータベースへの命令として扱われ、意図しない問い合わせや操作をされる問題です。読み取り・書き換えなど、可能なことは脆弱性ごとに異なります。", "sourceUrl": "https://cwe.mitre.org/data/definitions/89.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-7568", "aliases": [ "GHSA-96wq-48vp-hh57" ], "title": "PHP：脆弱性情報", "summary": "PHP の ext/standard/metaphone.c にある metaphone() 関数は、入力文字列の現在位置を示すために signed int 変数を使用しています。文字列が 2,147,483,647 バイトを超えて渡されると、符号付き整数のオーバーフローが発生し、未定義の動作になります。この未定義の動作により、範囲外読み取りが起こり、セグメンテーションフォルトや無関係なメモリへのアクセスが発生する可能性があり、PHP プロセスの可用性に影響を与えることがあります。", "risk": "範囲外読み取りによりセグメンテーションフォルトや無関係なメモリへのアクセスが起こり、PHP プロセスが利用できなくなる可能性があります。", "product": "PHP", "category": "php", "component": "core", "severity": "medium", "cvss": 6.3, "cvssVersion": "4.0", "cvssSource": "php", "cvssVector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/RE:L/U:Amber", "affected": [ { "product": "PHP", "range": "8.2.* / < 8.2.31" }, { "product": "PHP", "range": "8.3.* / < 8.3.31" }, { "product": "PHP", "range": "8.4.* / < 8.4.21" }, { "product": "PHP", "range": "8.5.* / < 8.5.6" }, { "product": "PHP", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。" } ], "fixed": [ "8.2.31", "8.3.31", "8.4.21", "8.5.6" ], "steps": [ "PHP 8.2.31、8.3.31、8.4.21、8.5.6 にアップデートすれば修正されます。", "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7568.json", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-96wq-48vp-hh57", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-7568", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2026-05-07T12:54:56.000Z", "modifiedAt": "2026-07-15T00:39:53.392Z", "fetchedAt": "2026-10-23T02:43:50.769Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function in ext/standard/metaphone.c uses a signed int variable to track the current position within the input string. If a string longer than 2,147,483,647 bytes is passed, a signed integer overflow occurs, resulting in undefined behavior. This can lead to an out-of-bounds read, causing a segmentation fault or access to unrelated memory, and may affect the availability of the PHP process.", "sourceTitle": "Signed integer overflow in metaphone()", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "PHP Group", "product": "PHP", "versions": [ { "status": "affected", "version": "8.2.*", "lessThan": "8.2.31", "versionType": "semver" }, { "status": "affected", "version": "8.3.*", "lessThan": "8.3.31", "versionType": "semver" }, { "status": "affected", "version": "8.4.*", "lessThan": "8.4.21", "versionType": "semver" }, { "status": "affected", "version": "8.5.*", "lessThan": "8.5.6", "versionType": "semver" } ], "defaultStatus": "affected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-7568", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7568.json", "fetchedAt": "2026-10-23T02:43:50.769Z", "publishedAt": "2026-05-10T03:42:36.433Z", "modifiedAt": "2026-07-15T00:39:53.392Z", "state": "published", "provider": "php", "title": "Signed integer overflow in metaphone()", "descriptions": [ { "lang": "en", "value": "In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function in ext/standard/metaphone.c uses a signed int variable to track the current position within the input string. If a string longer than 2,147,483,647 bytes is passed, a signed integer overflow occurs, resulting in undefined behavior. This can lead to an out-of-bounds read, causing a segmentation fault or access to unrelated memory, and may affect the availability of the PHP process.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "**Researcher: Aleksey Solovev (Positive Technologies)**\r\n\r\nThe PHP standard library provides the function `metaphone()` (php-src/ext/standard/metaphone.c). This function is used for searching and matching words based on their phonetic sound.\r\n\r\nThis function declares the variable `signed int w_idx`, keeping track of the current position into the string passed to `metaphone()`.\r\n\r\nhttps://github.com/php/php-src/blob/9498bc3ee131616344370f59d4f1a6bb46375750/ext/standard/metaphone.c#L171\r\n\r\nThe maximum value the `signed int` type can hold is (usually) `2_147_483_647`. In C, exceeding this value for signed types is undefined behavior. Frequently, the value will wrap around and result in the value `-2_147_483_648`, but this behavior is not guaranteed.\r\n\r\nIf the string passed to `metaphone()` has a length of `>2_147_483_647`, a signed integer overflow can occur, resulting in undefined behavior. Accessing the current word after an overflow can result in a segmentation fault or access unrelated memory.", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-96wq-48vp-hh57" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "affected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.2.*", "lessThan": "8.2.31", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.3.*", "lessThan": "8.3.31", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8.4.*", "lessThan": "8.4.21", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "8.5.*", "lessThan": "8.5.6", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package ext-standard; vulnerable range: < 8.2.31; patched versions: 8.2.31", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-96wq-48vp-hh57" }, { "lang": "en", "value": "Package ext-standard; vulnerable range: < 8.3.31; patched versions: 8.3.31", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-96wq-48vp-hh57" }, { "lang": "en", "value": "Package ext-standard; vulnerable range: < 8.4.21; patched versions: 8.4.21", "sourcePath": "/vulnerabilities/2/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-96wq-48vp-hh57" }, { "lang": "en", "value": "Package ext-standard; vulnerable range: < 8.5.6; patched versions: 8.5.6", "sourcePath": "/vulnerabilities/3/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-96wq-48vp-hh57" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-190", "lang": "en", "description": "CWE-190 Integer Overflow or Wraparound", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" }, { "cweId": "CWE-125", "lang": "en", "description": "CWE-125 Out-of-bounds Read", "sourcePath": "/containers/cna/problemTypes/1/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/RE:L/U:Amber", "baseScore": 6.3, "baseSeverity": "MEDIUM", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" }, { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/metrics/1/cvssV3_1" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-96wq-48vp-hh57", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-7568", "label": "redhat-SADP", "tags": [ "vdb-entry", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468566", "label": "RHBZ#2468566", "tags": [ "issue-tracking", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/1" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7568.json", "label": "redhat-SADP", "tags": [ "x_sadp-csaf-vex" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/2" }, { "url": "https://access.redhat.com/errata/RHSA-2026:23388", "label": "redhat-SADP", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/3" }, { "url": "https://access.redhat.com/errata/RHSA-2026:22649", "label": "redhat-SADP", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/4" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34354", "label": "redhat-SADP", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/5" }, { "url": "https://access.redhat.com/errata/RHSA-2026:22305", "label": "redhat-SADP", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/6" }, { "url": "https://access.redhat.com/errata/RHSA-2026:22142", "label": "redhat-SADP", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/7" }, { "url": "https://access.redhat.com/errata/RHSA-2026:22143", "label": "redhat-SADP", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/8" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33449", "label": "redhat-SADP", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/9" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7568.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"PHP Group\",\"product\":\"PHP\",\"versions\":[{\"status\":\"affected\",\"version\":\"8.2.*\",\"lessThan\":\"8.2.31\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.3.*\",\"lessThan\":\"8.3.31\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.4.*\",\"lessThan\":\"8.4.21\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.5.*\",\"lessThan\":\"8.5.6\",\"versionType\":\"semver\"}],\"defaultStatus\":\"affected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7568.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function in ext/standard/metaphone.c uses a signed int variable to track the current position within the input string. If a string longer than 2,147,483,647 bytes is passed, a signed integer overflow occurs, resulting in undefined behavior. This can lead to an out-of-bounds read, causing a segmentation fault or access to unrelated memory, and may affect the availability of the PHP process.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7568.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-190\",\"description\":\"CWE-190 Integer Overflow or Wraparound\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/problemTypes/1/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7568.json", "sourcePath": "/containers/cna/problemTypes/1/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-125\",\"description\":\"CWE-125 Out-of-bounds Read\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7568.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"LOW\",\"subConfidentialityImpact\":\"LOW\",\"vulnIntegrityImpact\":\"LOW\",\"subIntegrityImpact\":\"LOW\",\"vulnAvailabilityImpact\":\"LOW\",\"subAvailabilityImpact\":\"LOW\",\"exploitMaturity\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"LOW\",\"providerUrgency\":\"AMBER\",\"version\":\"4.0\",\"baseSeverity\":\"MEDIUM\",\"baseScore\":6.3,\"vectorString\":\"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/RE:L/U:Amber\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/1/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7568.json", "sourcePath": "/containers/adp/1/metrics/1/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-96wq-48vp-hh57:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-96wq-48vp-hh57", "sourcePath": "/description", "text": "**Researcher: Aleksey Solovev (Positive Technologies)**\r\n\r\nThe PHP standard library provides the function `metaphone()` (php-src/ext/standard/metaphone.c). This function is used for searching and matching words based on their phonetic sound.\r\n\r\nThis function declares the variable `signed int w_idx`, keeping track of the current position into the string passed to `metaphone()`.\r\n\r\nhttps://github.com/php/php-src/blob/9498bc3ee131616344370f59d4f1a6bb46375750/ext/standard/metaphone.c#L171\r\n\r\nThe maximum value the `signed int` type can hold is (usually) `2_147_483_647`. In C, exceeding this value for signed types is undefined behavior. Frequently, the value will wrap around and result in the value `-2_147_483_648`, but this behavior is not guaranteed.\r\n\r\nIf the string passed to `metaphone()` has a length of `>2_147_483_647`, a signed integer overflow can occur, resulting in undefined behavior. Accessing the current word after an overflow can result in a segmentation fault or access unrelated memory.", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-96wq-48vp-hh57:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-96wq-48vp-hh57", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-standard\"},\"vulnerable_version_range\":\"< 8.2.31\",\"patched_versions\":\"8.2.31\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-96wq-48vp-hh57:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-96wq-48vp-hh57", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-standard\"},\"vulnerable_version_range\":\"< 8.3.31\",\"patched_versions\":\"8.3.31\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-96wq-48vp-hh57:/vulnerabilities/2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-96wq-48vp-hh57", "sourcePath": "/vulnerabilities/2", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-standard\"},\"vulnerable_version_range\":\"< 8.4.21\",\"patched_versions\":\"8.4.21\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-96wq-48vp-hh57:/vulnerabilities/3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-96wq-48vp-hh57", "sourcePath": "/vulnerabilities/3", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-standard\"},\"vulnerable_version_range\":\"< 8.5.6\",\"patched_versions\":\"8.5.6\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2026-07-15T00:39:53.392Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-96wq-48vp-hh57", "modifiedAt": "2026-05-07T12:54:56.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-07-15T00:39:53.392Z", "fetchedAt": "2026-10-23T02:43:50.769Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2026-05-07T12:54:56.000Z", "fetchedAt": "2026-10-22T22:18:00.744Z", "state": "published" } ], "sourceSummary": "PHPに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:23:52.699Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "e5fb3c13b84fca98b03102906778f4659377e06329e817a7cdbbbab5a54ee9ab", "sourceModifiedAt": "2026-07-15T00:39:53.392Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "PHP の ext/standard/metaphone.c にある metaphone() 関数は、入力文字列の現在位置を示すために signed int 変数を使用しています。文字列が 2,147,483,647 バイトを超えて渡されると、符号付き整数のオーバーフローが発生し、未定義の動作になります。この未定義の動作により、範囲外読み取りが起こり、セグメンテーションフォルトや無関係なメモリへのアクセスが発生する可能性があり、PHP プロセスの可用性に影響を与えることがあります。", "risk": "範囲外読み取りによりセグメンテーションフォルトや無関係なメモリへのアクセスが起こり、PHP プロセスが利用できなくなる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "PHP 8.2.* で、バージョン 8.2.31 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7568.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "PHP 8.3.* で、バージョン 8.3.31 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7568.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "PHP 8.4.* で、バージョン 8.4.21 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7568.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "PHP 8.5.* で、バージョン 8.5.6 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7568.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "公式の対象表：PHP Group / PHP。影響ありとして記載：8.2系のうち、8.2.31未満。影響ありとして記載：8.3系のうち、8.3.31未満。影響ありとして記載：8.4系のうち、8.4.21未満。影響ありとして記載：8.5系のうち、8.5.6未満。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7568.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7568.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "PHP 8.2.31、8.3.31、8.4.21、8.5.6 にアップデートすれば修正されます。", "kind": "fix", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-96wq-48vp-hh57" ], "evidenceIds": [ "E4" ] }, { "text": "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php", "https://www.php.net/supported-versions.php", "https://documentation.ubuntu.com/security/security-updates/" ] } ], "temporaryMitigations": [ { "text": "自分でPHPの設定値を変更する前に、サーバー会社へ「このCVEに有効な回避策・副作用・修正予定」を確認してください。下の問い合わせ文を使えます。一般的なWAFやバックアップだけで修正済みとは扱わないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-7568", "https://github.com/php/php-src/security/advisories/GHSA-96wq-48vp-hh57" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7568.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7568.json", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-96wq-48vp-hh57", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-7568", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7568.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function in ext/standard/metaphone.c uses a signed int variable to track the current position within the input string. If a string longer than 2,147,483,647 bytes is passed, a signed integer overflow occurs, resulting in undefined behavior. This can lead to an out-of-bounds read, causing a segmentation fault or access to unrelated memory, and may affect the availability of the PHP process.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7568.json", "sourceField": "/containers/cna/title", "excerpt": "Signed integer overflow in metaphone()", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7568.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"PHP Group\",\"product\":\"PHP\",\"versions\":[{\"status\":\"affected\",\"version\":\"8.2.*\",\"lessThan\":\"8.2.31\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.3.*\",\"lessThan\":\"8.3.31\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.4.*\",\"lessThan\":\"8.4.21\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.5.*\",\"lessThan\":\"8.5.6\",\"versionType\":\"semver\"}],\"defaultStatus\":\"affected\"}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-96wq-48vp-hh57", "sourceField": "/fixed", "excerpt": "[\"8.2.31\",\"8.3.31\",\"8.4.21\",\"8.5.6\"]", "language": null } ], "supportRequest": "件名：CVE-2026-7568（PHP）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・PHP 8.2.* で、バージョン 8.2.31 未満は影響を受けます。\n・PHP 8.3.* で、バージョン 8.3.31 未満は影響を受けます。\n・PHP 8.4.* で、バージョン 8.4.21 未満は影響を受けます。\n・PHP 8.5.* で、バージョン 8.5.6 未満は影響を受けます。\n・公式の対象表：PHP Group / PHP。影響ありとして記載：8.2系のうち、8.2.31未満。影響ありとして記載：8.3系のうち、8.3.31未満。影響ありとして記載：8.4系のうち、8.4.21未満。影響ありとして記載：8.5系のうち、8.5.6未満。個別に例外が記されていない版も、原資料では影響ありとされています。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-7568", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:23:52.699Z", "lastSuccess": "2026-10-23T03:23:52.699Z", "sourceCheckedAt": "2026-10-23T02:43:50.769Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-7263", "aliases": [ "GHSA-4jhr-8w89-j733" ], "title": "PHP：サービス停止", "summary": "PHP 8.4.* の 8.4.21 未満、または 8.5.* の 8.5.6 未満のバージョンにおいて、DOMNode::C14N() メソッドが XML データを誤って処理し、XML 文書を表すデータ構造に循環リンクリストが生成される可能性があります。この結果、XML 文書の以降の処理が無限ループに入り、処理アプリケーションでサービス拒否が発生します。", "risk": "無限ループによりアプリケーションが停止し、サービス拒否（DoS）が発生する可能性があります。", "product": "PHP", "category": "php", "component": "core", "severity": "medium", "cvss": 6.3, "cvssVersion": "4.0", "cvssSource": "php", "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/AU:Y/RE:M/U:Amber", "affected": [ { "product": "PHP", "range": "8.4.* / < 8.4.21" }, { "product": "PHP", "range": "8.5.* / < 8.5.6" } ], "fixed": [ "8.4.21", "8.5.6" ], "steps": [ "PHP を 8.4.21 以上、または 8.5.6 以上にアップデートしてください。", "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7263.json", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-4jhr-8w89-j733", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-7263", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2026-05-07T12:54:39.000Z", "modifiedAt": "2026-07-15T00:40:16.236Z", "fetchedAt": "2026-10-23T02:43:50.372Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.", "sourceTitle": "DoS attack via DOMNode::C14N()", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "PHP Group", "product": "PHP", "packageName": "dom", "versions": [ { "status": "affected", "version": "8.4.*", "lessThan": "8.4.21", "versionType": "semver" }, { "status": "affected", "version": "8.5.*", "lessThan": "8.5.6", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-7263", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7263.json", "fetchedAt": "2026-10-23T02:43:50.372Z", "publishedAt": "2026-05-10T04:43:04.483Z", "modifiedAt": "2026-07-15T00:40:16.236Z", "state": "published", "provider": "php", "title": "DoS attack via DOMNode::C14N()", "descriptions": [ { "lang": "en", "value": "In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "**Researcher: Nikita Sveshnikov (Positive Technologies)**\r\n\r\nIn `DOMNode::C14N()`, improper removal of a `xmlns` libxml2 attribute from a doubly linked list can lead to a corrupt, circular linked list. The linked list is iterated in many places in PHP and libxml2, leading to DoS through segfaults, or temporal and spatial resource starvation.\r\n\r\n\r\n\r\nThe attribute is removed incorrectly here:\r\n\r\nhttps://github.com/php/php-src/blob/f0f28b763c8696511c3b80fb8b25ae8765b2d94b/ext/dom/node.c#L2134-L2141\r\n\r\nNotice the `attr->prev = attr->next;` instead of `attr->prev->next = attr->next;`. The attribute is later (correctly) restored here:\r\n\r\nhttps://github.com/php/php-src/blob/f0f28b763c8696511c3b80fb8b25ae8765b2d94b/ext/dom/node.c#L2182-L2189\r\n\r\nAfter both procedures, the following graph:\r\n\r\n\r\n\r\nWould result in this graph:\r\n\r\n\r\n\r\nContinuously following `next` will result in an infinite loop.", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-4jhr-8w89-j733" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "packageName": "dom", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.4.*", "lessThan": "8.4.21", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.5.*", "lessThan": "8.5.6", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package ext-dom; vulnerable range: < 8.4.21; patched versions: 8.4.21", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-4jhr-8w89-j733" }, { "lang": "en", "value": "Package ext-dom; vulnerable range: < 8.5.6; patched versions: 8.5.6", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-4jhr-8w89-j733" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-404", "lang": "en", "description": "CWE-404 Improper Resource Shutdown or Release", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" }, { "cweId": "CWE-835", "lang": "en", "description": "CWE-835 Loop with unreachable exit condition ('infinite loop')", "sourcePath": "/containers/cna/problemTypes/1/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/AU:Y/RE:M/U:Amber", "baseScore": 6.3, "baseSeverity": "MEDIUM", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" }, { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/metrics/1/cvssV3_1" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-4jhr-8w89-j733", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-7263", "label": "redhat-SADP", "tags": [ "vdb-entry", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468572", "label": "RHBZ#2468572", "tags": [ "issue-tracking", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/1" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7263.json", "label": "redhat-SADP", "tags": [ "x_sadp-csaf-vex" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/2" }, { "url": "https://access.redhat.com/errata/RHSA-2026:22649", "label": "redhat-SADP", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/3" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7263.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"PHP Group\",\"product\":\"PHP\",\"packageName\":\"dom\",\"versions\":[{\"status\":\"affected\",\"version\":\"8.4.*\",\"lessThan\":\"8.4.21\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.5.*\",\"lessThan\":\"8.5.6\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7263.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7263.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-404\",\"description\":\"CWE-404 Improper Resource Shutdown or Release\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/problemTypes/1/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7263.json", "sourcePath": "/containers/cna/problemTypes/1/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-835\",\"description\":\"CWE-835 Loop with unreachable exit condition ('infinite loop')\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7263.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"LOW\",\"subAvailabilityImpact\":\"LOW\",\"exploitMaturity\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"YES\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"MODERATE\",\"providerUrgency\":\"AMBER\",\"version\":\"4.0\",\"baseSeverity\":\"MEDIUM\",\"baseScore\":6.3,\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/AU:Y/RE:M/U:Amber\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/1/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7263.json", "sourcePath": "/containers/adp/1/metrics/1/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-4jhr-8w89-j733:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-4jhr-8w89-j733", "sourcePath": "/description", "text": "**Researcher: Nikita Sveshnikov (Positive Technologies)**\r\n\r\nIn `DOMNode::C14N()`, improper removal of a `xmlns` libxml2 attribute from a doubly linked list can lead to a corrupt, circular linked list. The linked list is iterated in many places in PHP and libxml2, leading to DoS through segfaults, or temporal and spatial resource starvation.\r\n\r\n\r\n\r\nThe attribute is removed incorrectly here:\r\n\r\nhttps://github.com/php/php-src/blob/f0f28b763c8696511c3b80fb8b25ae8765b2d94b/ext/dom/node.c#L2134-L2141\r\n\r\nNotice the `attr->prev = attr->next;` instead of `attr->prev->next = attr->next;`. The attribute is later (correctly) restored here:\r\n\r\nhttps://github.com/php/php-src/blob/f0f28b763c8696511c3b80fb8b25ae8765b2d94b/ext/dom/node.c#L2182-L2189\r\n\r\nAfter both procedures, the following graph:\r\n\r\n\r\n\r\nWould result in this graph:\r\n\r\n\r\n\r\nContinuously following `next` will result in an infinite loop.", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-4jhr-8w89-j733:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-4jhr-8w89-j733", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-dom\"},\"vulnerable_version_range\":\"< 8.4.21\",\"patched_versions\":\"8.4.21\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-4jhr-8w89-j733:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-4jhr-8w89-j733", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-dom\"},\"vulnerable_version_range\":\"< 8.5.6\",\"patched_versions\":\"8.5.6\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2026-07-15T00:40:16.236Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-4jhr-8w89-j733", "modifiedAt": "2026-05-07T14:31:30.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-07-15T00:40:16.236Z", "fetchedAt": "2026-10-23T02:43:50.372Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2026-05-07T14:31:30.000Z", "fetchedAt": "2026-10-22T22:18:00.744Z", "state": "published" } ], "sourceSummary": "PHPにサービス停止に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "処理の停止や過大な負荷により、サービスを利用できなくなる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:23:52.950Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "606224e74f842084da41bccbfe33e159c8ac7eed495dd7d4dadb0de4b92ba5e1", "sourceModifiedAt": "2026-07-15T00:40:16.236Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "PHP 8.4.* の 8.4.21 未満、または 8.5.* の 8.5.6 未満のバージョンにおいて、DOMNode::C14N() メソッドが XML データを誤って処理し、XML 文書を表すデータ構造に循環リンクリストが生成される可能性があります。この結果、XML 文書の以降の処理が無限ループに入り、処理アプリケーションでサービス拒否が発生します。", "risk": "無限ループによりアプリケーションが停止し、サービス拒否（DoS）が発生する可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "PHP 8.4.* でバージョンが 8.4.21 未満のものは影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7263.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "PHP 8.5.* でバージョンが 8.5.6 未満のものは影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7263.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "公式の対象表：PHP Group / PHP。影響ありとして記載：8.4系のうち、8.4.21未満。影響ありとして記載：8.5系のうち、8.5.6未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7263.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7263.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "PHP を 8.4.21 以上、または 8.5.6 以上にアップデートしてください。", "kind": "fix", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-4jhr-8w89-j733" ], "evidenceIds": [ "E4" ] }, { "text": "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php", "https://www.php.net/supported-versions.php", "https://documentation.ubuntu.com/security/security-updates/" ] } ], "temporaryMitigations": [ { "text": "自分でPHPの設定値を変更する前に、サーバー会社へ「このCVEに有効な回避策・副作用・修正予定」を確認してください。下の問い合わせ文を使えます。一般的なWAFやバックアップだけで修正済みとは扱わないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-7263", "https://github.com/php/php-src/security/advisories/GHSA-4jhr-8w89-j733" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7263.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7263.json", "label": "CVE：php" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-4jhr-8w89-j733", "label": "PHP開発元のアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-7263", "label": "CVE公式レコード" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7263.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7263.json", "sourceField": "/containers/cna/title", "excerpt": "DoS attack via DOMNode::C14N()", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7263.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"PHP Group\",\"product\":\"PHP\",\"packageName\":\"dom\",\"versions\":[{\"status\":\"affected\",\"version\":\"8.4.*\",\"lessThan\":\"8.4.21\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.5.*\",\"lessThan\":\"8.5.6\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://github.com/php/php-src/security/advisories/GHSA-4jhr-8w89-j733", "sourceField": "/fixed", "excerpt": "[\"8.4.21\",\"8.5.6\"]", "language": null } ], "supportRequest": "件名：CVE-2026-7263（PHP）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・PHP 8.4.* でバージョンが 8.4.21 未満のものは影響を受けます。\n・PHP 8.5.* でバージョンが 8.5.6 未満のものは影響を受けます。\n・公式の対象表：PHP Group / PHP。影響ありとして記載：8.4系のうち、8.4.21未満。影響ありとして記載：8.5系のうち、8.5.6未満。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-7263", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:23:52.950Z", "lastSuccess": "2026-10-23T03:23:52.950Z", "sourceCheckedAt": "2026-10-23T02:43:50.372Z", "errorCode": null }, "glossary": [ { "term": "サービス拒否（DoS）", "meaning": "サービスや機能が停止したり、処理が遅くなったりして、通常どおり利用できなくなることです。", "sourceUrl": "https://cwe.mitre.org/data/definitions/400.html", "kind": "general_definition" } ] } } ], "total": 2205, "limit": 20, "offset": 560, "filters": { "product": "all", "type": "all", "q": "", "page": 29 }, "pagination": { "page": 29, "pageSize": 20, "totalPages": 111 }, "sources": [ { "name": "JVN", "status": "ok", "lastSuccess": "2026-10-23T22:17:49.999Z", "lastAttempt": "2026-10-23T22:17:49.999Z", "error": null, "recordCount": 20, "coverage": "JVNの新着・更新RSS。取得した記事を蓄積。JVN iPediaは含みません。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "PHP Security", "status": "error", "lastSuccess": "2026-10-23T21:17:50.096Z", "lastAttempt": "2026-10-23T22:17:49.999Z", "error": "GitHub API取得上限に到達 (2026-10-23T22:37:16.000Z以降に再取得)", "recordCount": 66, "coverage": "PHP開発元の公開アドバイザリ。公開日が新しい順とは限らない直近100件を取得し蓄積。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "CISA KEV", "status": "ok", "lastSuccess": "2026-10-23T22:17:49.999Z", "lastAttempt": "2026-10-23T22:17:49.999Z", "error": null, "recordCount": 1756, "coverage": "CISAの公式GitHubミラーにある悪用確認済み一覧全件。掲載日はKEV追加日。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "NVD", "status": "partial", "lastSuccess": "2026-10-23T19:17:50.573Z", "lastAttempt": "2026-10-23T22:17:49.999Z", "error": "未確認のページ・期間は次回の定期取得で続きから反映します。", "recordCount": 7, "coverage": "WordPressを含む脆弱性。初回は公開7日分、以降は全製品の変更分からWordPressと保存済みIDを追跡。停止後は最後に確認できた時刻から最大7日幅・500件ずつ再開し、残りは次回取得。 今回: 2026-10-23T19:02:50.573Z 〜 2026-10-23T21:17:50.096Z、全製品の変更 1000/2168件まで確認、対象7件反映。", "cursor": { "start": "2026-10-23T19:02:50.573Z", "end": "2026-10-23T21:17:50.096Z", "kind": "modified", "index": 1000 }, "freshness": "stale", "stale": true }, { "name": "CVE", "status": "ok", "lastSuccess": "2026-10-23T22:17:49.999Z", "lastAttempt": "2026-10-23T22:17:49.999Z", "error": null, "recordCount": 6, "coverage": "取得したPHP/JVN情報のうち、公開日が新しい最大6件のCVE公式レコードで条件を補足。 PHP公式ニュース経由で候補補足（先頭20項目から2件）。GitHub全件代替ではない。CVE取得は既存候補と合わせ最大6件。", "cursor": null, "freshness": "fresh", "stale": false } ] }