CVE-2026-85234— Tftp: tftp-hpa: denial of service due to out-of-bounds read/write in remap engine
Quick assessment
Affected
Red Hat Red Hat Enterprise Linux 10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
tftp-hpa 中发现了一个缺陷。当 的重映射（remap）引擎处理一条同时中止连接并附带非空自定义错误消息的逆向重映射规则时，它可能会将无效的匹配偏移量传递给 函数，从而导致越界读取或写入操作。远程未经身份验证的攻击者可以通过发送特制请求利用此漏洞，导致守护进程崩溃，进而引发拒绝服务（DoS）。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of ServiceAffected Version Matrix 6
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 6 | any |
unknown |
| Red Hat | Red Hat Enterprise Linux 7 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 8 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 9 | any |
affected |
| Red Hat | Red Hat Hardened Images | any |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-85234
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Tftp: tftp-hpa: denial of service due to out-of-bounds read/write in remap engine
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in tftp-hpa. When the `in.tftpd` remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the `genmatchstring()` function. This leads to out-of-bounds read/write operations. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request, causing the daemon to crash and resulting in a denial of service.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 6 | - |
cpe:/o:redhat:enterprise_linux:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 | - |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat Hardened Images | - |
cpe:/a:redhat:hummingbird:1
|
|
II. Public POCs for CVE-2026-85234
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-85234
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-85234 (1)
Vendor Advisories for CVE-2026-85234 (1)
Other References for CVE-2026-85234 (1)
Same Patch Batch · Red Hat · 2026-09-15 · 9 CVEs total
| CVE-2026-85013 | 7.3 HIGH | Environment-modules: command injection in environment-modules bash completion via maliciou |
| CVE-2026-75092 | 7.3 HIGH | Leapp-repository: leapp-upgrade-el9toel10: leapp-upgrade-el9toel10: scan_mysql runs mysqld |
| CVE-2026-81303 | 6.3 MEDIUM | Hawtio-operator: hawtio-operator: routes/custom-host confused-deputy via spec.routehostnam |
| CVE-2026-91786 | 6.1 MEDIUM | Gnome-shell: gnome-shell: out-of-bounds read in remote search icon rendering due to unvali |
| CVE-2026-81320 | 5.5 MEDIUM | Hawtio-operator: hawtio-operator: tls private key written to operator log at debug level |
| CVE-2026-79705 | 4.5 MEDIUM | Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outsi |
| CVE-2026-79699 | 4.4 MEDIUM | Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacem |
| CVE-2026-91926 | 3.7 LOW | Gss-ntlmssp: gss-ntlmssp: memory leak in ntlm_decode_target_info via duplicated av_pair en |
IV. Related Vulnerabilities
Same product: Red Hat Enterprise Linux 10
-
CVE-2026-85013
Environment-modules: command injection in environment-module -
CVE-2026-91786
Gnome-shell: gnome-shell: out-of-bounds read in remote searc -
CVE-2026-90996
Sssd: sssd: denial of service in nss responder via crafted z -
CVE-2026-90995
Sssd: sssd: local denial of service due to null pointer dere -
CVE-2026-90994
Sssd: sssd: denial of service via malformed pam v1 requests
Same vendor: Red Hat
-
CVE-2026-79699
Podman: buildah: skopeo: containers/storage: malicious tar w -
CVE-2026-79705
Podman: buildah: buildah/copier: directory escape via crafte -
CVE-2026-85013
Environment-modules: command injection in environment-module -
CVE-2026-91926
Gss-ntlmssp: gss-ntlmssp: memory leak in ntlm_decode_target_ -
CVE-2026-91786
Gnome-shell: gnome-shell: out-of-bounds read in remote searc
Same weakness: CWE-125
-
CVE-2026-92176
pdfforge PDF Architect App Object Out-Of-Bounds Read Remote -
CVE-2026-55211
surfio IRAP header size fields cause out-of-bounds reads -
CVE-2026-91959
FreeRDP before 3.31.0 Buffer Over-read via RTS Gateway -
CVE-2026-91958
FreeRDP 3.11.0 through 3.30.0 Heap Buffer Overflow via Monit -
CVE-2026-91956
FreeRDP before 3.31.0 Out-of-Bounds Read via URBDRC
V. Comments for CVE-2026-85234
No comments yet