CVE-2026-107446
containerd overlaybd through 1.0.18 has a do_load_index (LSMT index loading) integer overflow (and resultant out-of-bounds heap access) for index_bytes, if an untrusted overlaybd blob from a registry
containerd overlaybdContainers & cloud
CVSS
6.8MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.41%Chance of exploitation activity in the next 30 days, higher than 33% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
containerd overlaybd through 1.0.18 has a do_load_index (LSMT index loading) integer overflow (and resultant out-of-bounds heap access) for index_bytes, if an untrusted overlaybd blob from a registry is used in a scenario with multiple overlaybd-backed containers.
Text from CVE List
Affected versions 1
- overlaybdaffected: all versions through 1.0.18CVE List
References 5
- github.com/containerd/overlaybd/commit/a536e3341c82517268b5ce32375b36faecb1fb40Fixvia CVE List
- github.com/containerd/overlaybd/commit/d80c1790920a17e84da025675530624aee753f1bFixvia CVE List
- github.com/containerd/overlaybd/blob/58f1508f4c841fe27da428f54d987000f7dae4de/src/overlaybd/lsmt/file.cppReferencevia CVE List
- github.com/containerd/overlaybd/blob/58f1508f4c841fe27da428f54d987000f7dae4de/src/image_file.cppReferencevia CVE List
- github.com/containerd/overlaybd/pull/438Referencevia CVE List