{"id":"CVE-2026-107446","details":"containerd overlaybd through 1.0.18 has a do_load_index (LSMT index loading) integer overflow (and resultant out-of-bounds heap access) for index_bytes, if an untrusted overlaybd blob from a registry is used in a scenario with multiple overlaybd-backed containers.","modified":"2026-10-10T07:06:09.709351104Z","published":"2026-10-08T03:37:19.484Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107446.json","cna_assigner":"mitre","cwe_ids":["CWE-190"]},"references":[{"type":"WEB","url":"https://github.com/containerd/overlaybd/blob/58f1508f4c841fe27da428f54d987000f7dae4de/src/image_file.cpp"},{"type":"WEB","url":"https://github.com/containerd/overlaybd/blob/58f1508f4c841fe27da428f54d987000f7dae4de/src/overlaybd/lsmt/file.cpp"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107446.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107446"},{"type":"FIX","url":"https://github.com/containerd/overlaybd/commit/a536e3341c82517268b5ce32375b36faecb1fb40"},{"type":"FIX","url":"https://github.com/containerd/overlaybd/commit/d80c1790920a17e84da025675530624aee753f1b"},{"type":"FIX","url":"https://github.com/containerd/overlaybd/pull/438"},{"type":"PACKAGE","url":"https://github.com/containerd/overlaybd"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/containerd/overlaybd","events":[{"introduced":"0"},{"fixed":"cee2186ca75670f6c3d48a4b79c2b43a7134fba5"},{"fixed":"a536e3341c82517268b5ce32375b36faecb1fb40"},{"fixed":"d80c1790920a17e84da025675530624aee753f1b"}],"database_specific":{"source":["DESCRIPTION","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"1.0.18"}]}}],"versions":["v1.0.17","v1.0.15","v1.0.16","v1.0.16rc.1","v1.0.14","v1.0.13","v1.0.12","v1.0.11","v1.0.10","v1.0.9","v1.0.8","v1.0.7","v1.0.6","v1.0.5","v1.0.4","v1.0.3","v1.0.2","v1.0.1","v0.6.19","v1.0.0","v0.6.18","v0.6.17","v0.6.16","v0.6.15","v0.6.14","v0.6.13","v0.6.12","v0.6.10","v0.6.9","v0.6.8","v0.6.7","v0.6.6","v0.6.5","v0.6.4","v0.6.3","v0.6.2","v0.6.1","v0.6.0","v0.5.2","v0.5.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107446.json","vanir_signatures":[{"source":"https://github.com/containerd/overlaybd/commit/a536e3341c82517268b5ce32375b36faecb1fb40","target":{"file":"src/overlaybd/lsmt/index.cpp","function":"merge_memory_indexes"},"deprecated":false,"digest":{"function_hash":"82111653283401854648890925331775640397","length":716},"id":"CVE-2026-107446-01a72250","signature_type":"Function","signature_version":"v1"},{"digest":{"line_hashes":["150633996801161752681404214657353099838","94442043711311386948946066521006435902","50145953660962741827104460255298238153","260866463748765486716469633200791539568","148483124168763770313978198409037114719","70675343550394929941039938293641971521","96469164809869047695419228352588513898","15955739096906802831705444339841443379","318795857209479343215607944308600026891","307516023166144512127661840978022871675","319182793988358970928286514518081968300"],"threshold":0.9},"id":"CVE-2026-107446-17a329ba","signature_type":"Line","signature_version":"v1","source":"https://github.com/containerd/overlaybd/commit/a536e3341c82517268b5ce32375b36faecb1fb40","target":{"file":"src/overlaybd/zfile/zfile.cpp"},"deprecated":false},{"target":{"file":"src/overlaybd/zfile/test/test.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["116440052932478926517492875656654026649","175223300768895099294835578786721669491","212660761856824846862151242265276260917"]},"id":"CVE-2026-107446-1f574e73","signature_type":"Line","signature_version":"v1","source":"https://github.com/containerd/overlaybd/commit/a536e3341c82517268b5ce32375b36faecb1fb40"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/containerd/overlaybd/commit/a536e3341c82517268b5ce32375b36faecb1fb40","target":{"file":"src/overlaybd/lsmt/test/test.cpp"},"deprecated":false,"digest":{"line_hashes":["293169986432059085782514360148504331714","290841936046295155498079287092078866221","140175530676124648390403363559589929510","222616764885068914894034780254491817956","91079264406857678328079672602344402061","70304610560235533809188493908399296265"],"threshold":0.9},"id":"CVE-2026-107446-32a40b6c"},{"signature_version":"v1","source":"https://github.com/containerd/overlaybd/commit/a536e3341c82517268b5ce32375b36faecb1fb40","target":{"function":"load_jump_table","file":"src/overlaybd/zfile/zfile.cpp"},"deprecated":false,"digest":{"function_hash":"246799486609446934747872074582707269023","length":3350},"id":"CVE-2026-107446-4a4362e1","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["233003223884442110060377716242337501717","207243089168138649138586989178163366484","156543986211430022316448193471814973773","288461796681334142653832816008644178025","197982477256095618302418843011480626528","79861283372238935222302757183673325301","41756101390175229804416958777789191129","26405728901607229413173642211461426261","184678592345894429010070494002563801621","150353946359098786997828339492175583529","279936763351590502130985815568316110303","297858242644299203513255463032955805994"],"threshold":0.9},"id":"CVE-2026-107446-533f6f92","signature_type":"Line","signature_version":"v1","source":"https://github.com/containerd/overlaybd/commit/a536e3341c82517268b5ce32375b36faecb1fb40","target":{"file":"src/overlaybd/lsmt/file.cpp"}},{"source":"https://github.com/containerd/overlaybd/commit/a536e3341c82517268b5ce32375b36faecb1fb40","target":{"function":"merge_indexes","file":"src/overlaybd/lsmt/index.cpp"},"deprecated":false,"digest":{"length":1309,"function_hash":"263502893013763859729482775544272697056"},"id":"CVE-2026-107446-57eac6bb","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-107446-7aae5416","signature_type":"Function","signature_version":"v1","source":"https://github.com/containerd/overlaybd/commit/a536e3341c82517268b5ce32375b36faecb1fb40","target":{"file":"src/overlaybd/lsmt/file.cpp","function":"do_load_index"},"deprecated":false,"digest":{"function_hash":"48252576178540663919115335723286205900","length":2238}},{"source":"https://github.com/containerd/overlaybd/commit/a536e3341c82517268b5ce32375b36faecb1fb40","target":{"file":"src/overlaybd/lsmt/index.cpp"},"deprecated":false,"digest":{"line_hashes":["165503483461071732110718782043669768997","13525096446108984882572192157335961104","145960380702350903394409495939937302296","271405288468538728873865899145896188899","174704987567834450985800974863286420423","123542873043957063591032572539748438254","289248768074877092220737031055712719354","154370190784248781653816034448382647770","223011056262003118871390418315591542779","33635944696769093409778741665062311416","157311034831614843129776377253537948207","13920739382307401916089620137091979770","163348089106914964796579069640772303899","229522751734488179035607043730048058835","173277661023088138324224152634822055966","196038349861763888399865462951101193495","280409733703471492136528862654320743630","38182114046676814022206910529447123429","15332914310294335955379699801660242105","293198809685722457936960251193386311485","72219470332146480529822511327308112778","320447364091906412060436533091497152286","237033868840539512711181504723713352978","35749940086909127187614010547263326751","22930620164434408431137473354075716107","65907077250654684472540950891287742026","156283260641700124044091570524449129035","169156475025186951490718986524929117217","136146724739661103215944153610735352495","163519686392674903910061754495636968786","167460348306614372880315870077091987658","297339236992342397980365237685753231197","225686113984008833836468069386580933949","15051475023696540361864015942675316079","131541822971130837903152673648566642133","108472021768408041455111080679144250868","33838768512974876025090828500835200346","37546079827152238247733990065131247007","202882221196306336979481681272585452351","103314514885291337131806992719120068220","318138412783974124711344318934587251798","53961838082655355768452462443318843259","56929775915251329052324719303545293343","190367098551022007091362127008377633864","194973283123636645984048081494213402362","211636318218836319827139918301497301250","276224235483974524599992248315443067389","49261351827108855824895356217149087251","35662691936337025866044185493915949351","192143260788622932849671501507936712639","84817923724426207014706105834629492424","132503588769223224647186269590542727227","335251242140796948286901276240362978721","61294930336970237525903631865809296756","174265802812987343588654540474194728544","11306732916884576289744891352033623694","86397838696094328426024068454112946422","16197664629764402283265193834414026855","223117367089657493708060690043179359427","147609253848427175560782308623354412008"],"threshold":0.9},"id":"CVE-2026-107446-7f33e342","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/containerd/overlaybd/commit/a536e3341c82517268b5ce32375b36faecb1fb40","target":{"file":"src/overlaybd/lsmt/file.cpp","function":"verify_ht"},"deprecated":false,"digest":{"function_hash":"96609760174496524823383982420431119399","length":1045},"id":"CVE-2026-107446-822ba1fa","signature_type":"Function","signature_version":"v1"},{"digest":{"threshold":0.9,"line_hashes":["193593971125697099304640102445924130125","173739772509411003310823296371279081652","16518069977594735360504527624560313069","167365808507810286779051517562093339147"]},"id":"CVE-2026-107446-e67aba3c","signature_type":"Line","signature_version":"v1","source":"https://github.com/containerd/overlaybd/commit/a536e3341c82517268b5ce32375b36faecb1fb40","target":{"file":"src/overlaybd/lsmt/index.h"},"deprecated":false}],"vanir_signatures_modified":"2026-10-10T07:06:09Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H"}]}