{"id":"UBUNTU-CVE-2026-122056","details":"A flaw was found in OpenSCAP. A heap-based buffer overflow can occur when processing a specially crafted Extensible Configuration Checklist Description Format (XCCDF) document using the sds-compose option. An attacker could exploit this vulnerability to corrupt memory, resulting in an application crash and a Denial of Service (DoS).","modified":"2026-11-11T09:39:20.867461909Z","published":"2026-11-10T00:00:00Z","upstream":["CVE-2026-122056"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-122056"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-122056"},{"type":"REPORT","url":"access.redhat.com/downloads/content/package-browser"}],"affected":[{"package":{"name":"openscap","ecosystem":"Ubuntu:Pro:16.04:LTS","purl":"pkg:deb/ubuntu/openscap?arch=source&distro=esm-apps%2Fxenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.3-1build2","1.2.7-1","1.2.7-1build1","1.2.8-1","1.2.8-1ubuntu0.1","1.2.8-1ubuntu0.2","1.2.8-1ubuntu0.3","1.2.8-1ubuntu03+esm2","1.2.8-1ubuntu03+esm3"],"ecosystem_specific":{"binaries":[{"binary_name":"libopenscap-perl","binary_version":"1.2.8-1ubuntu03+esm3"},{"binary_name":"libopenscap8","binary_version":"1.2.8-1ubuntu03+esm3"},{"binary_name":"python-openscap","binary_version":"1.2.8-1ubuntu03+esm3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-122056.json"}},{"package":{"name":"openscap","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/openscap?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.14-1build1","1.2.15-1","1.2.15-1build1","1.2.15-1ubuntu0.1","1.2.15-1ubuntu0.2","1.2.15-1ubuntu0.3","1.2.15-1ubuntu0.4"],"ecosystem_specific":{"binaries":[{"binary_version":"1.2.15-1ubuntu0.4","binary_name":"libopenscap-perl"},{"binary_name":"libopenscap8","binary_version":"1.2.15-1ubuntu0.4"},{"binary_name":"python-openscap","binary_version":"1.2.15-1ubuntu0.4"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-122056.json"}},{"package":{"name":"openscap","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/openscap?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.16-2ubuntu1","1.2.16-2ubuntu2","1.2.16-2ubuntu3","1.2.16-2ubuntu3.1","1.2.16-2ubuntu3.2","1.2.16-2ubuntu3.3","1.2.16-2ubuntu3.4"],"ecosystem_specific":{"binaries":[{"binary_version":"1.2.16-2ubuntu3.4","binary_name":"libopenscap-perl"},{"binary_name":"libopenscap8","binary_version":"1.2.16-2ubuntu3.4"},{"binary_name":"python-openscap","binary_version":"1.2.16-2ubuntu3.4"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-122056.json"}},{"package":{"name":"openscap","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/openscap?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.17-0.1ubuntu5","1.2.17-0.1ubuntu7","1.2.17-0.1ubuntu7.22.04.1","1.2.17-0.1ubuntu7.22.04.2","1.2.17-0.1ubuntu7.22.04.3"],"ecosystem_specific":{"binaries":[{"binary_name":"libopenscap-perl","binary_version":"1.2.17-0.1ubuntu7.22.04.3"},{"binary_name":"libopenscap8","binary_version":"1.2.17-0.1ubuntu7.22.04.3"},{"binary_name":"python3-openscap","binary_version":"1.2.17-0.1ubuntu7.22.04.3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-122056.json"}},{"package":{"name":"openscap","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/openscap?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.8+dfsg-3","1.3.9+dfsg-1","1.3.9+dfsg-1build1","1.3.9+dfsg-1build2","1.3.9+dfsg-1.1ubuntu1","1.3.9+dfsg-1.1ubuntu2"],"ecosystem_specific":{"binaries":[{"binary_version":"1.3.9+dfsg-1.1ubuntu2","binary_name":"libopenscap-perl"},{"binary_version":"1.3.9+dfsg-1.1ubuntu2","binary_name":"libopenscap25t64"},{"binary_version":"1.3.9+dfsg-1.1ubuntu2","binary_name":"openscap-common"},{"binary_name":"openscap-scanner","binary_version":"1.3.9+dfsg-1.1ubuntu2"},{"binary_version":"1.3.9+dfsg-1.1ubuntu2","binary_name":"openscap-utils"},{"binary_name":"python3-openscap","binary_version":"1.3.9+dfsg-1.1ubuntu2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-122056.json"}},{"package":{"name":"openscap","ecosystem":"Ubuntu:26.10","purl":"pkg:deb/ubuntu/openscap?arch=source&distro=stonking"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.3+dfsg-1build1","1.4.4+dfsg-1","1.4.4+dfsg-1ubuntu1","1.4.4+dfsg-1ubuntu2","1.4.4+dfsg-2"],"ecosystem_specific":{"binaries":[{"binary_name":"libopenscap-perl","binary_version":"1.4.4+dfsg-2"},{"binary_version":"1.4.4+dfsg-2","binary_name":"libopenscap33"},{"binary_name":"openscap-common","binary_version":"1.4.4+dfsg-2"},{"binary_name":"openscap-scanner","binary_version":"1.4.4+dfsg-2"},{"binary_name":"openscap-utils","binary_version":"1.4.4+dfsg-2"},{"binary_version":"1.4.4+dfsg-2","binary_name":"python3-openscap"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-122056.json"}},{"package":{"name":"openscap","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/openscap?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.2+dfsg-2","1.4.2+dfsg-2build1","1.4.3+dfsg-1","1.4.3+dfsg-1build1","1.4.3+dfsg-1ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_version":"1.4.3+dfsg-1ubuntu1","binary_name":"libopenscap-perl"},{"binary_name":"libopenscap33","binary_version":"1.4.3+dfsg-1ubuntu1"},{"binary_name":"openscap-common","binary_version":"1.4.3+dfsg-1ubuntu1"},{"binary_version":"1.4.3+dfsg-1ubuntu1","binary_name":"openscap-scanner"},{"binary_version":"1.4.3+dfsg-1ubuntu1","binary_name":"openscap-utils"},{"binary_version":"1.4.3+dfsg-1ubuntu1","binary_name":"python3-openscap"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-122056.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H"},{"type":"Ubuntu","score":"medium"}]}