{"id":"UBUNTU-CVE-2026-110661","details":"CGNS through 4.5.2 contains a stack out-of-bounds read vulnerability in ADFI_read_node_header that allows attackers to crash applications by supplying crafted ADF node headers. Attackers can craft .cgns or .adf files whose non-NUL-terminated end tag causes ADFI_stridx_c to scan past disk_node_data, crashing tools like cgnslist.","modified":"2026-10-17T12:58:03.739298415Z","published":"2026-10-15T00:00:00Z","upstream":["CVE-2026-110661"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-110661"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-110661"},{"type":"REPORT","url":"https://github.com/CGNS/CGNS"},{"type":"REPORT","url":"https://github.com/CGNS/CGNS/blob/3a972d92559787a49c5f9a54974ea1946ecb9d21/src/adf/ADF_internals.c#L6828"},{"type":"REPORT","url":"https://hackmd.io/@haind-pwn/cgns-adf-node-header-oob-read"},{"type":"REPORT","url":"https://www.vulncheck.com/advisories/cgns-through-4.5.2-stack-out-of-bounds-read-via-adfi-read-node-header"}],"affected":[{"package":{"name":"libcgns","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/libcgns?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.4.2-2build2"],"ecosystem_specific":{"binaries":[{"binary_name":"cgns-convert","binary_version":"3.1.4.2-2build2"},{"binary_version":"3.1.4.2-2build2","binary_name":"libcgns3.1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-110661.json"}},{"package":{"name":"libcgns","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/libcgns?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.0-4","3.3.0-5"],"ecosystem_specific":{"binaries":[{"binary_name":"cgns-convert","binary_version":"3.3.0-5"},{"binary_name":"libcgns3.3","binary_version":"3.3.0-5"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-110661.json"}},{"package":{"name":"libcgns","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/libcgns?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.0-6build2","3.3.0-7","3.4.0-1"],"ecosystem_specific":{"binaries":[{"binary_name":"cgns-convert","binary_version":"3.4.0-1"},{"binary_version":"3.4.0-1","binary_name":"libcgns3.4"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-110661.json"}},{"package":{"name":"libcgns","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/libcgns?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.0-3"],"ecosystem_specific":{"binaries":[{"binary_version":"3.4.0-3","binary_name":"cgns-convert"},{"binary_version":"3.4.0-3","binary_name":"libcgns3.4"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-110661.json"}},{"package":{"name":"libcgns","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/libcgns?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.0-3","3.4.0-3build1","3.4.0-4"],"ecosystem_specific":{"binaries":[{"binary_version":"3.4.0-4","binary_name":"cgns-convert"},{"binary_version":"3.4.0-4","binary_name":"libcgns3.4"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-110661.json"}},{"package":{"name":"libcgns","ecosystem":"Ubuntu:26.10","purl":"pkg:deb/ubuntu/libcgns?arch=source&distro=stonking"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.0-1","4.5.0-2"],"ecosystem_specific":{"binaries":[{"binary_name":"cgns-convert","binary_version":"4.5.0-2"},{"binary_name":"libcgns4.5","binary_version":"4.5.0-2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-110661.json"}},{"package":{"name":"libcgns","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/libcgns?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.0-5build1","4.5.0-1"],"ecosystem_specific":{"binaries":[{"binary_name":"cgns-convert","binary_version":"4.5.0-1"},{"binary_version":"4.5.0-1","binary_name":"libcgns4.5"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-110661.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}]}