{"schema":"threatline.record/2","record":{"id":"CVE-2026-111137","aliases":[],"summary":"libsmi through 0.5.0 Out-of-Bounds Write via smiValueAsString OCTET STRING DEFVAL","details":"libsmi through 0.5.0 contains an out-of-bounds write vulnerability in smiValueAsString() in lib/smi.c that allows attackers to overflow a fixed 1024-byte static buffer through hex rendering of OCTET STRING values. Attackers can supply a crafted MIB with an OCTET STRING DEFVAL of 512 or more octets and a leading 0x00 byte to corrupt adjacent library globals and crash smidump or other consumers.","categories":["Unclassified"],"product":"libsmi","vendor":"amartin755","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111137","source_modified_at":"2026-10-16T17:10:45.000Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"libsmi","vendor":"amartin755","versions":[{"version":"0","lessThanOrEqual":"0.5.0","status":"affected","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":6.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.0013,"percentile":0.02363,"score_date":"2026-10-23"},"published_at":"2026-10-15T18:57:30.581Z","modified_at":"2026-10-16T17:10:45.000Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-111137","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-16T17:10:45.000Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111137","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://hackmd.io/@haind-pwn/libsmi-smivalueasstring-octetstring-defval-oob-write","tags":["technical-description","exploit"]},{"source":"CVE List","url":"https://github.com/amartin755/libsmi/blob/c58307210fe995ec419db976eb234aebc71a9216/lib/smi.c#L479-L566","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/amartin755/libsmi","tags":["product"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/libsmi-through-0.5.0-out-of-bounds-write-via-smivalueasstring-octet-string-defval","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-16T16:28:04.914973Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-16T17:10:45.000Z","content_hash":"9ff307e1d9a09d5b9a67d317ccb07d58b480b8a02d82887013389cd40a2566ca"}}