CVE-2026-53670

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-53670

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53670.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-53670

Aliases

GHSA-2qc8-qh94-66rc

Published

2026-09-02T17:54:43.900Z

Modified

2026-09-04T08:03:32.906379Z

Severity

9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

PREVAIL: Non-singleton typeset in add() skips offset update, allowing OOB access to pass eBPF verification

Details

PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, in the Prevail eBPF verifier, EbpfTransformer::add() silently skips offset-variable updates when the destination register carries a non-singleton typeset (two or more simultaneously possible pointer types). Subsequent bounds checks use the stale offset and accept out-of-bounds memory accesses, so a crafted BPF program passes verification even though it would corrupt memory at runtime. This issue has been patched in version 0.2.4.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53670.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-682"
    ]
}

References

Affected packages

Git / github.com/vbpf/prevail

Affected ranges

Type

GIT

Repo

https://github.com/vbpf/prevail

Events

Introduced

Fixed

2b209bc4e3d612ff9aca87125e67c0ff84477e61

Fixed

67b6d03ebaa3341e2eee2aa74502003fd11e31de

Database specific

Show details

{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.2.4"
        }
    ]
}

Affected versions

v0.*

v0.1-alpha

v0.1.2

v0.1.3

v0.2.0

v0.2.1

v0.2.2

v0.2.3

Database specific

vanir_signatures

[
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 812.0,
            "function_hash": "149107321059926243648741704344611706279"
        },
        "id": "CVE-2026-53670-2ea651e8",
        "target": {
            "function": "EbpfTransformer::add",
            "file": "src/crab/ebpf_transformer.cpp"
        },
        "source": "https://github.com/vbpf/prevail/commit/2b209bc4e3d612ff9aca87125e67c0ff84477e61",
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 11346.0,
            "function_hash": "12164238122894191941039599099260904981"
        },
        "id": "CVE-2026-53670-b35887bc",
        "target": {
            "function": "operator()",
            "file": "src/crab/ebpf_transformer.cpp"
        },
        "source": "https://github.com/vbpf/prevail/commit/2b209bc4e3d612ff9aca87125e67c0ff84477e61",
        "signature_version": "v1"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "304491419162453290356338220022779475431",
                "94689232370400547400142164522909234934",
                "133719515442885128385103998727845323928",
                "82823086780892311056627489772476887346",
                "20058582462633862398170202549141310947",
                "39166430856288306204700620537372480818",
                "318187952497468142550553287452269969382",
                "284212162268814531287861930003096226588",
                "32684156488085279205321812954525036903",
                "194833722410781835244708179499863069851",
                "7234050154554438867018716884048273642",
                "118235377282646206201354053416799847863",
                "98271309632033821737117755820297143716",
                "310274198019034761871038645536778796593"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-53670-c0458a0e",
        "target": {
            "file": "src/crab/ebpf_transformer.cpp"
        },
        "source": "https://github.com/vbpf/prevail/commit/2b209bc4e3d612ff9aca87125e67c0ff84477e61",
        "signature_version": "v1"
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53670.json"

vanir_signatures_modified

"2026-09-04T08:03:32Z"