CVE-2026-79900Heap overflow in KSL checksum initialization
Updated under an hour ago ()
Does this affect you?
It affects Fortra BoKS Manager boks-server. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
boks_ksllogsd accepts a checksum algorithm name in the MD field of an authenticated KSL start message. Affected releases verify that OpenSSL recognizes the digest name but do not verify that the value fits in a fixed 16-byte checksum context field before copying it. An authenticated KSL client can supply an oversized, OpenSSL-recognized digest name and write beyond the end of the heap allocation.
- CVSS
- 6.5 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- CWE-787
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Fortra
- NVD analysis
- Awaiting Analysis
- Record last updated
- Oct 1, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Fortra BoKS Manager boks-server fortra:boks_manager_boks_server (from the name) | before 8.1.0.24; before 9.0.0.7 | CNA record |
References
- https://www.fortra.com/security/advisories/product-security/fi-2026-013
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.