CVE-2026-107446

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-107446
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107446.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-107446
Published
2026-10-08T03:37:19Z
Modified
2026-10-10T07:06:09Z
Severity
  • 6.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

containerd overlaybd through 1.0.18 has a do_load_index (LSMT index loading) integer overflow (and resultant out-of-bounds heap access) for index_bytes, if an untrusted overlaybd blob from a registry is used in a scenario with multiple overlaybd-backed containers.

Database specific 
{
    "cna_assigner":  "mitre",
    "cwe_ids":  [
        "CWE-190"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107446.json"
}
References

Affected packages

Git / github.com/containerd/overlaybd

Affected ranges

Type
GIT
Repo
https://github.com/containerd/overlaybd
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
cee2186ca75670f6c3d48a4b79c2b43a7134fba5
Fixed
a536e3341c82517268b5ce32375b36faecb1fb40
Fixed
d80c1790920a17e84da025675530624aee753f1b
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "1.0.18"
        }
    ],
    "source":  [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.5.2
v0.5.3
v0.6.0
v0.6.1
v0.6.10
v0.6.12
v0.6.13
v0.6.14
v0.6.15
v0.6.16
v0.6.17
v0.6.18
v0.6.19
v0.6.2
v0.6.3
v0.6.4
v0.6.5
v0.6.6
v0.6.7
v0.6.8
v0.6.9
v1.*
v1.0.0
v1.0.1
v1.0.10
v1.0.11
v1.0.12
v1.0.13
v1.0.14
v1.0.15
v1.0.16
v1.0.16rc.1
v1.0.17
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107446.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "82111653283401854648890925331775640397",
            "length":  716
        },
        "id":  "CVE-2026-107446-01a72250",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/containerd/overlaybd/commit/a536e3341c82517268b5ce32375b36faecb1fb40",
        "target":  {
            "file":  "src/overlaybd/lsmt/index.cpp",
            "function":  "merge_memory_indexes"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "150633996801161752681404214657353099838",
                "94442043711311386948946066521006435902",
                "50145953660962741827104460255298238153",
                "260866463748765486716469633200791539568",
                "148483124168763770313978198409037114719",
                "70675343550394929941039938293641971521",
                "96469164809869047695419228352588513898",
                "15955739096906802831705444339841443379",
                "318795857209479343215607944308600026891",
                "307516023166144512127661840978022871675",
                "319182793988358970928286514518081968300"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-107446-17a329ba",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/containerd/overlaybd/commit/a536e3341c82517268b5ce32375b36faecb1fb40",
        "target":  {
            "file":  "src/overlaybd/zfile/zfile.cpp"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "116440052932478926517492875656654026649",
                "175223300768895099294835578786721669491",
                "212660761856824846862151242265276260917"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-107446-1f574e73",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/containerd/overlaybd/commit/a536e3341c82517268b5ce32375b36faecb1fb40",
        "target":  {
            "file":  "src/overlaybd/zfile/test/test.cpp"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "293169986432059085782514360148504331714",
                "290841936046295155498079287092078866221",
                "140175530676124648390403363559589929510",
                "222616764885068914894034780254491817956",
                "91079264406857678328079672602344402061",
                "70304610560235533809188493908399296265"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-107446-32a40b6c",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/containerd/overlaybd/commit/a536e3341c82517268b5ce32375b36faecb1fb40",
        "target":  {
            "file":  "src/overlaybd/lsmt/test/test.cpp"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "246799486609446934747872074582707269023",
            "length":  3350
        },
        "id":  "CVE-2026-107446-4a4362e1",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/containerd/overlaybd/commit/a536e3341c82517268b5ce32375b36faecb1fb40",
        "target":  {
            "file":  "src/overlaybd/zfile/zfile.cpp",
            "function":  "load_jump_table"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "233003223884442110060377716242337501717",
                "207243089168138649138586989178163366484",
                "156543986211430022316448193471814973773",
                "288461796681334142653832816008644178025",
                "197982477256095618302418843011480626528",
                "79861283372238935222302757183673325301",
                "41756101390175229804416958777789191129",
                "26405728901607229413173642211461426261",
                "184678592345894429010070494002563801621",
                "150353946359098786997828339492175583529",
                "279936763351590502130985815568316110303",
                "297858242644299203513255463032955805994"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-107446-533f6f92",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/containerd/overlaybd/commit/a536e3341c82517268b5ce32375b36faecb1fb40",
        "target":  {
            "file":  "src/overlaybd/lsmt/file.cpp"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "263502893013763859729482775544272697056",
            "length":  1309
        },
        "id":  "CVE-2026-107446-57eac6bb",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/containerd/overlaybd/commit/a536e3341c82517268b5ce32375b36faecb1fb40",
        "target":  {
            "file":  "src/overlaybd/lsmt/index.cpp",
            "function":  "merge_indexes"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "48252576178540663919115335723286205900",
            "length":  2238
        },
        "id":  "CVE-2026-107446-7aae5416",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/containerd/overlaybd/commit/a536e3341c82517268b5ce32375b36faecb1fb40",
        "target":  {
            "file":  "src/overlaybd/lsmt/file.cpp",
            "function":  "do_load_index"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "165503483461071732110718782043669768997",
                "13525096446108984882572192157335961104",
                "145960380702350903394409495939937302296",
                "271405288468538728873865899145896188899",
                "174704987567834450985800974863286420423",
                "123542873043957063591032572539748438254",
                "289248768074877092220737031055712719354",
                "154370190784248781653816034448382647770",
                "223011056262003118871390418315591542779",
                "33635944696769093409778741665062311416",
                "157311034831614843129776377253537948207",
                "13920739382307401916089620137091979770",
                "163348089106914964796579069640772303899",
                "229522751734488179035607043730048058835",
                "173277661023088138324224152634822055966",
                "196038349861763888399865462951101193495",
                "280409733703471492136528862654320743630",
                "38182114046676814022206910529447123429",
                "15332914310294335955379699801660242105",
                "293198809685722457936960251193386311485",
                "72219470332146480529822511327308112778",
                "320447364091906412060436533091497152286",
                "237033868840539512711181504723713352978",
                "35749940086909127187614010547263326751",
                "22930620164434408431137473354075716107",
                "65907077250654684472540950891287742026",
                "156283260641700124044091570524449129035",
                "169156475025186951490718986524929117217",
                "136146724739661103215944153610735352495",
                "163519686392674903910061754495636968786",
                "167460348306614372880315870077091987658",
                "297339236992342397980365237685753231197",
                "225686113984008833836468069386580933949",
                "15051475023696540361864015942675316079",
                "131541822971130837903152673648566642133",
                "108472021768408041455111080679144250868",
                "33838768512974876025090828500835200346",
                "37546079827152238247733990065131247007",
                "202882221196306336979481681272585452351",
                "103314514885291337131806992719120068220",
                "318138412783974124711344318934587251798",
                "53961838082655355768452462443318843259",
                "56929775915251329052324719303545293343",
                "190367098551022007091362127008377633864",
                "194973283123636645984048081494213402362",
                "211636318218836319827139918301497301250",
                "276224235483974524599992248315443067389",
                "49261351827108855824895356217149087251",
                "35662691936337025866044185493915949351",
                "192143260788622932849671501507936712639",
                "84817923724426207014706105834629492424",
                "132503588769223224647186269590542727227",
                "335251242140796948286901276240362978721",
                "61294930336970237525903631865809296756",
                "174265802812987343588654540474194728544",
                "11306732916884576289744891352033623694",
                "86397838696094328426024068454112946422",
                "16197664629764402283265193834414026855",
                "223117367089657493708060690043179359427",
                "147609253848427175560782308623354412008"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-107446-7f33e342",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/containerd/overlaybd/commit/a536e3341c82517268b5ce32375b36faecb1fb40",
        "target":  {
            "file":  "src/overlaybd/lsmt/index.cpp"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "96609760174496524823383982420431119399",
            "length":  1045
        },
        "id":  "CVE-2026-107446-822ba1fa",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/containerd/overlaybd/commit/a536e3341c82517268b5ce32375b36faecb1fb40",
        "target":  {
            "file":  "src/overlaybd/lsmt/file.cpp",
            "function":  "verify_ht"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "193593971125697099304640102445924130125",
                "173739772509411003310823296371279081652",
                "16518069977594735360504527624560313069",
                "167365808507810286779051517562093339147"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-107446-e67aba3c",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/containerd/overlaybd/commit/a536e3341c82517268b5ce32375b36faecb1fb40",
        "target":  {
            "file":  "src/overlaybd/lsmt/index.h"
        }
    }
]
vanir_signatures_modified 
"2026-10-10T07:06:09Z"