{"api_version":"1","generated_at":"2026-11-12T12:53:28+00:00","cve":"CVE-2026-111434","urls":{"html":"https://cve.report/CVE-2026-111434","api":"https://cve.report/api/cve/CVE-2026-111434.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-111434","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-111434"},"summary":{"title":"CVE-2026-111434","description":"Use of Externally-Controlled format string vulnerability in openEuler iSulad on Linux.\n\nThis vulnerability is associated with program file src/daemon/modules/image/oci/oci_load.c.\n\n\n\nThis issue affects iSulad: through 2.1.6.\n\n\n\nWhen the iSulad daemon performs container lifecycle operations (such as create, start, exec, stop, etc.) through the isula runtime (shim), the daemon reads the stderr output of the shim process via a pipe for error information display. If the buffer contains format specifiers such as %s, %x, or %n, it may trigger a format string vulnerability, potentially leading to information leakage, denial of service, or the risk of arbitrary writes.","state":"PUBLISHED","assigner":"openEuler","published_at":"2026-11-12 04:17:17","updated_at":"2026-11-12 10:17:27"},"problem_types":["CWE-134","CWE-134 CWE-134 Use of Externally-Controlled format string"],"metrics":[{"version":"3.1","source":"securities@openeuler.org","type":"Secondary","score":"5.6","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H","baseScore":5.6,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"5.6","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H","data":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.6,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H","version":"3.1"}}],"references":[{"url":"https://atomgit.com/src-openeuler/iSulad/pull/812","name":"https://atomgit.com/src-openeuler/iSulad/pull/812","refsource":"securities@openeuler.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4865","name":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4865","refsource":"securities@openeuler.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://atomgit.com/openeuler/iSulad/commit/697cb26a5946d56bbb2c5533bab72f4376d8421b?ref=master&prId=2650","name":"https://atomgit.com/openeuler/iSulad/commit/697cb26a5946d56bbb2c5533bab72f4376d8421b?ref=master&prId=2650","refsource":"securities@openeuler.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-111434","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111434","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"openEuler","product":"iSulad","version":"affected 2.1.6 rpm","platforms":["Linux"]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Fengyi Wang","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"collectionURL":"https://atomgit.com/src-openeuler/iSulad","defaultStatus":"affected","packageName":"iSulad","platforms":["Linux"],"product":"iSulad","programFiles":["src/daemon/modules/image/oci/oci_load.c"],"repo":"https://atomgit.com/openeuler/iSulad","vendor":"openEuler","versions":[{"lessThanOrEqual":"2.1.6","status":"affected","version":"0","versionType":"rpm"}]}],"credits":[{"lang":"en","type":"finder","value":"Fengyi Wang"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Use of Externally-Controlled format string vulnerability in openEuler iSulad on Linux.<p>This vulnerability is associated with program file src/daemon/modules/image/oci/oci_load.c.</p><p>This issue affects iSulad: through 2.1.6.</p><p>When the iSulad daemon performs container lifecycle operations (such as create, start, exec, stop, etc.) through the isula runtime (shim), the daemon reads the stderr output of the shim process via a pipe for error information display. If the buffer contains format specifiers such as %s, %x, or %n, it may trigger a format string vulnerability, potentially leading to information leakage, denial of service, or the risk of arbitrary writes.</p>"}],"value":"Use of Externally-Controlled format string vulnerability in openEuler iSulad on Linux.\n\nThis vulnerability is associated with program file src/daemon/modules/image/oci/oci_load.c.\n\n\n\nThis issue affects iSulad: through 2.1.6.\n\n\n\nWhen the iSulad daemon performs container lifecycle operations (such as create, start, exec, stop, etc.) through the isula runtime (shim), the daemon reads the stderr output of the shim process via a pipe for error information display. If the buffer contains format specifiers such as %s, %x, or %n, it may trigger a format string vulnerability, potentially leading to information leakage, denial of service, or the risk of arbitrary writes."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.6,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-134","description":"CWE-134 Use of Externally-Controlled format string","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-12T09:16:02.029Z","orgId":"7e1ac599-2767-43fa-b3ea-f10178cc98f2","shortName":"openEuler"},"references":[{"tags":["patch"],"url":"https://atomgit.com/openeuler/iSulad/commit/697cb26a5946d56bbb2c5533bab72f4376d8421b?ref=master&prId=2650"},{"tags":["patch"],"url":"https://atomgit.com/src-openeuler/iSulad/pull/812"},{"tags":["vendor-advisory"],"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4865"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 1.0.5"}}},"cveMetadata":{"assignerOrgId":"7e1ac599-2767-43fa-b3ea-f10178cc98f2","assignerShortName":"openEuler","cveId":"CVE-2026-111434","datePublished":"2026-11-12T03:47:33.383Z","dateReserved":"2026-10-16T02:50:14.526Z","dateUpdated":"2026-11-12T09:16:02.029Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-12 04:17:17","lastModifiedDate":"2026-11-12 10:17:27","problem_types":["CWE-134","CWE-134 CWE-134 Use of Externally-Controlled format string"],"metrics":{"cvssMetricV31":[{"source":"securities@openeuler.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H","baseScore":5.6,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":4.7}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"111434","Ordinal":"1","Title":"CVE-2026-111434","CVE":"CVE-2026-111434","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"111434","Ordinal":"1","NoteData":"Use of Externally-Controlled format string vulnerability in openEuler iSulad on Linux.\n\nThis vulnerability is associated with program file src/daemon/modules/image/oci/oci_load.c.\n\n\n\nThis issue affects iSulad: through 2.1.6.\n\n\n\nWhen the iSulad daemon performs container lifecycle operations (such as create, start, exec, stop, etc.) through the isula runtime (shim), the daemon reads the stderr output of the shim process via a pipe for error information display. If the buffer contains format specifiers such as %s, %x, or %n, it may trigger a format string vulnerability, potentially leading to information leakage, denial of service, or the risk of arbitrary writes.","Type":"Description","Title":"CVE-2026-111434"}]}}}