{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-14316", "assignerOrgId": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "state": "PUBLISHED", "assignerShortName": "Fortra", "dateReserved": "2026-07-01T11:40:47.817Z", "datePublished": "2026-10-01T16:16:36.508Z", "dateUpdated": "2026-10-01T16:32:54.604Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "shortName": "Fortra", "dateUpdated": "2026-10-01T16:16:36.508Z"}, "title": "Heap buffer overflow in boks_sshd revoked-key error handling", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-122", "description": "CWE-122 Heap-based buffer overflow", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "affected": [{"vendor": "Fortra", "product": "Core Privileged Access Manager (BoKS)", "versions": [{"status": "affected", "version": "8.1.0.0", "lessThan": "8.1.0.30", "versionType": "custom"}, {"status": "affected", "version": "10.1.0.0", "lessThan": "10.1.1.0", "versionType": "custom"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "The revoked-key error path builds a human-readable failure reason using sprintf() into a heap buffer. The allocated buffer is too small for the final formatted message. When sprintf() writes the full message, it can write past the end of the heap allocation.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>The revoked-key error path builds a human-readable failure reason using sprintf() into a heap buffer. T<span>he allocated buffer is too small for the final formatted message. When sprintf() writes the full message, it can write past the end of the heap allocation.&nbsp;</span></p>"}]}], "references": [{"url": "https://www.fortra.com/security/advisories/product-security/fi-2026-019"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseSeverity": "HIGH", "baseScore": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"}}], "configurations": [{"lang": "en", "value": "This is reachable when RevokedKeys is configured and public-key authentication checks a revoked key or encounters an error while checking the revoked-keys file.\n\n\nRevokedKeys must be configured, and the attacker must be able to initiate SSH public-key authentication with a key that is revoked or otherwise triggers an error in revoked-key checking.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "This is reachable when RevokedKeys is configured and public-key authentication checks a revoked key or encounters an error while checking the revoked-keys file.<div><br></div><div><span>RevokedKeys must be configured, and the attacker must be able to initiate SSH public-key authentication with a key that is revoked or otherwise triggers an error in revoked-key checking.</span>&nbsp;</div>"}]}], "solutions": [{"lang": "en", "value": "Upgrade to a patched version.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Upgrade to a patched version."}]}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-01T16:32:47.169777Z", "id": "CVE-2026-14316", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-01T16:32:54.604Z"}}]}}

{}

{}

{}

{}