{"id":"CVE-2026-107446","aliases":["EUVD-2026-94691","GHSA-x6rr-cr6c-gvp3"],"status":"published","title":"containerd overlaybd through 1.0.18 has a do_load_index (LSMT index loading) integer overflow ...","description":"containerd overlaybd through 1.0.18 has a do_load_index (LSMT index loading) integer overflow (and resultant out-of-bounds heap access) for index_bytes, if an untrusted overlaybd blob from a registry is used in a scenario with multiple overlaybd-backed containers.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00407,"percentile":0.35489,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-190"],"published":"2026-10-08T03:37:19Z","modified":"2026-10-28T10:46:02Z","products":[{"vendor":"containerd","product":"overlaybd"}],"references":[{"url":"https://github.com/containerd/overlaybd/blob/58f1508f4c841fe27da428f54d987000f7dae4de/src/overlaybd/lsmt/file.cpp","tags":["web"]},{"url":"https://github.com/containerd/overlaybd/blob/58f1508f4c841fe27da428f54d987000f7dae4de/src/image_file.cpp","tags":["web"]},{"url":"https://github.com/containerd/overlaybd/pull/438","tags":["fix"]},{"url":"https://github.com/containerd/overlaybd/commit/a536e3341c82517268b5ce32375b36faecb1fb40","tags":["fix"]},{"url":"https://github.com/containerd/overlaybd/commit/d80c1790920a17e84da025675530624aee753f1b","tags":["fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107446","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-x6rr-cr6c-gvp3"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107446.json","tags":["advisory"]},{"url":"https://github.com/containerd/overlaybd","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-107446","description":"containerd overlaybd through 1.0.18 has a do_load_index (LSMT index loading) integer overflow (and resultant out-of-bounds heap access) for index_bytes, if an untrusted overlaybd blob from a registry is used in a scenario with multiple overlaybd-backed containers.","status":"published","published":"2026-10-08T03:37:19.484Z","modified":"2026-10-08T17:55:50.535Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T13:45:25.313702Z"}],"euvd":[{"id":"EUVD-2026-94691","description":"containerd overlaybd through 1.0.18 has a do_load_index (LSMT index loading) integer overflow (and resultant out-of-bounds heap access) for index_bytes, if an untrusted overlaybd blob from a registry is used in a scenario with multiple overlaybd-backed containers.","status":"published","published":"2026-10-08T03:37:19Z","modified":"2026-10-08T17:55:50Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T17:27:28.108203Z"}],"ghsa":[{"id":"GHSA-x6rr-cr6c-gvp3","title":"containerd overlaybd through 1.0.18 has a do_load_index (LSMT index loading) integer overflow ...","description":"containerd overlaybd through 1.0.18 has a do_load_index (LSMT index loading) integer overflow (and resultant out-of-bounds heap access) for index_bytes, if an untrusted overlaybd blob from a registry is used in a scenario with multiple overlaybd-backed containers.","status":"published","published":"2026-10-08T06:31:16Z","modified":"2026-10-08T06:31:22Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:12:55.932488Z"}],"nvd":[{"id":"CVE-2026-107446","description":"containerd overlaybd through 1.0.18 has a do_load_index (LSMT index loading) integer overflow (and resultant out-of-bounds heap access) for index_bytes, if an untrusted overlaybd blob from a registry is used in a scenario with multiple overlaybd-backed containers.","status":"published","published":"2026-10-08T04:17:19.41Z","modified":"2026-10-08T21:33:42.423Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:12:55.142936Z"}],"osv":[{"id":"CVE-2026-107446","description":"containerd overlaybd through 1.0.18 has a do_load_index (LSMT index loading) integer overflow (and resultant out-of-bounds heap access) for index_bytes, if an untrusted overlaybd blob from a registry is used in a scenario with multiple overlaybd-backed containers.","status":"published","published":"2026-10-08T03:37:19.484Z","modified":"2026-10-28T10:46:02.742511958Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:44:54.933106Z"}]}}