CVE-2026-64667

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-64667
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64667.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-64667
Aliases
  • GHSA-gc6f-5hpq-ghxh
Published
2026-11-11T03:51:59Z
Modified
2026-11-12T07:04:19Z
Severity
  • 4.4 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L CVSS Calculator
Summary
pam_usb: Heap out-of-bounds read in pusb_get_tty_from_display_server cmdline scan
Details

pam_usb provides hardware authentication for Linux using removable media. Prior to version 0.9.3, src/local.c (pusb_get_tty_from_display_server) allocates a 4096-byte cmdline buffer, reads up to 4096 bytes from /proc//cmdline, then replaces every NUL separator with a space. When read(2) returns exactly 4096 bytes for any process the function inspects, the buffer ends without a terminator and the subsequent strstr() calls scan past the allocation boundary. The function is invoked during normal PAM authentication when DISPLAY is set, so the read fires for every process at auth time. Consequences are bounded: strstr output is a Boolean substring match (limited info-disclosure surface) but a hostile heap layout can produce a SIGSEGV that terminates the host PAM process. This issue has been patched in version 0.9.3.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-125"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64667.json"
}
References

Affected packages

Git / github.com/mcdope/pam_usb

Affected ranges

Type
GIT
Repo
https://github.com/mcdope/pam_usb
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
9993723a2836c7de547ea380af521ed5f5b51651
Fixed
d0a2e716241304cdb069adfaf54d2ede629d57fa
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "0.9.3"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "d0a2e716241304cdb069adfaf54d2ede629d57fa"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "0.9.3",
            "range": [
                {
                    "fixed": "9993723a2836c7de547ea380af521ed5f5b51651"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

0.*
0.5.0
0.7.1
0.7.2
0.7.3
0.8.3
0.8.4
0.8.7
0.9.0
0.9.1
0.9.2
v0.*
v0.7.0
v0.8.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64667.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "287700966311119806853618570869320949957",
                "135593712737333566968619918124455502442",
                "28493360793453521948917225950795101463",
                "58246638911668754416592706100835325359",
                "3631829903789495940496161748387784571",
                "300707980347143847849136209349946533243",
                "118298050146220481983233354403680547263",
                "122905996348219465899235713501982943892",
                "132665601075891831803717891944251019487",
                "84591023142379925088579501699893755947",
                "323277390566551130461704934049371087390",
                "138840153723894249946940053752022283435",
                "83819128387055266727694749645222719877",
                "310802888258723076157897591850996881610",
                "126354924135654226010274128245272655786",
                "109941607549037070945631772261799856774",
                "127277633452116347873838030511819036180",
                "220997628838669876206539075346233317370",
                "281977757475083362010454748599030703068",
                "92215399137040891623165878250559169682",
                "270886140800751391964388748060297925451",
                "262741094449648921099097102233126891024",
                "2740406112742585775854677435166285896",
                "79597092275598406979279257769930560827",
                "115857890475516933485021243049535808967",
                "116957914000776597124769294320979027284",
                "233965776350329552092980983209350634574",
                "159050500694432662415167794980866939097",
                "6355368495034030004609367001867206543"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-64667-1e603efa",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/mcdope/pam_usb/commit/d0a2e716241304cdb069adfaf54d2ede629d57fa",
        "target": {
            "file": "src/local.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "72809191239261768997777755131974684145",
            "length": 1071
        },
        "id": "CVE-2026-64667-5c3ab238",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/mcdope/pam_usb/commit/d0a2e716241304cdb069adfaf54d2ede629d57fa",
        "target": {
            "file": "tests/unit/c/local_test.c",
            "function": "main"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "90234235966516307219071545107882742220",
            "length": 2285
        },
        "id": "CVE-2026-64667-a66540db",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/mcdope/pam_usb/commit/d0a2e716241304cdb069adfaf54d2ede629d57fa",
        "target": {
            "file": "src/local.c",
            "function": "pusb_get_tty_from_display_server"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "113429447358849411935277542129331960817",
                "110245807471078115352986451469761790321",
                "294731194792315458123927250748201470510",
                "320402228986047795475304463107323398167",
                "168053413586690550335512189872707293212",
                "14094631804457844343723649924406852594",
                "138193180431697723363162831429397046518",
                "44657392357987321750895668504181055926",
                "268518883270269332546345548748619421390",
                "157498236175435130877477404895415557188",
                "193247596877275029457438142175112159569"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-64667-e11e0506",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/mcdope/pam_usb/commit/d0a2e716241304cdb069adfaf54d2ede629d57fa",
        "target": {
            "file": "tests/unit/c/local_test.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "196826471672966929406198729402906788408"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-64667-fc51f96e",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/mcdope/pam_usb/commit/9993723a2836c7de547ea380af521ed5f5b51651",
        "target": {
            "file": "src/version.h"
        }
    }
]
vanir_signatures_modified 
"2026-11-12T07:04:19Z"