CVE-2026-64667— pam_usb: Heap out-of-bounds read in pusb_get_tty_from_display_server cmdline scan

Quick assessment

Affected

mcdope pam_usb

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

pam_usb 利用可移动介质为 Linux 提供硬件身份验证。在 0.9.3 版本之前，src/local.c 中的 pusb_get_tty_from_display_server 函数会分配一个 4096 字节的命令行缓冲区，从 /proc/<pid>/cmdline 读取最多 4096 字节的数据，随后将每个 NUL 分隔符替换为空格。当被检查的任意进程的 read(2) 调用恰好返回 4096 字节时，该缓冲区末尾将缺少终止符，导致后续调用的 strstr() 扫描超出分配边界。该函数在设置 DISPLA

CVSS 4.4 · Medium Updated Nov 11, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

pam_usb: Heap out-of-bounds read in pusb_get_tty_from_display_server cmdline scan

Source: CVE Program / CVE List V5

Vulnerability Description

pam_usb provides hardware authentication for Linux using removable media. Prior to version 0.9.3, src/local.c (pusb_get_tty_from_display_server) allocates a 4096-byte cmdline buffer, reads up to 4096 bytes from /proc//cmdline, then replaces every NUL separator with a space. When read(2) returns exactly 4096 bytes for any process the function inspects, the buffer ends without a terminator and the subsequent strstr() calls scan past the allocation boundary. The function is invoked during normal PAM authentication when DISPLAY is set, so the read fires for every process at auth time. Consequences are bounded: strstr output is a Boolean substring match (limited info-disclosure surface) but a hostile heap layout can produce a SIGSEGV that terminates the host PAM process. This issue has been patched in version 0.9.3.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

跨界内存读

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
mcdope	pam_usb	< 0.9.3	-

II. Public POCs for CVE-2026-64667

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-64667

请登录查看更多情报信息。

Other References for CVE-2026-64667 (5)

https://github.com/mcdope/pam_usb/pull/426 x_refsource_MISC
https://github.com/mcdope/pam_usb/issues/411 x_refsource_MISC
https://github.com/mcdope/pam_usb/releases/tag/0.9.3 x_refsource_MISC
https://github.com/mcdope/pam_usb/security/advisories/GHSA-gc6f-5hpq-ghxh x_refsource_CONFIRM
https://github.com/mcdope/pam_usb/commit/d0a2e716241304cdb069adfaf54d2ede629d57fa x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-64667

Same Patch Batch · mcdope · 2026-11-11 · 4 CVEs total

CVE-2026-64668	7.4 HIGH	pam_usb: deny_remote bypassed by zone-indexed IPv6 addresses (fe80::1%eth0) in pusb_tmux_h
CVE-2026-64669	7.4 HIGH	pam_usb: deny_remote bypassed by compressed IPv6 addresses in pusb_tmux_has_remote_clients
CVE-2026-64666	7.1 HIGH	pam_usb: getenv() in pusb_local_login bypasses XRDP deny via env-var unset

IV. Related Vulnerabilities

Same product: pam_usb

Same vendor: mcdope

Same weakness: CWE-125