CVE-2026-18938: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-18938 is an integer overflow vulnerability in p11-kit's RPC message parsing that leads to a heap out-of-bounds write, resulting in a Denial of Service (DoS). A local attacker, or one with equivalent access to a reachable RPC channel, can send specially crafted messages to trigger miscalculated memory allocation for nested attributes. The vulnerability is only exploitable on 32-bit (ILP32) systems where CK_ULONG is 32 bits. It was reported on May 18, 2026 and publicly disclosed on August 7, 2026, with a CVSS v3.1 base score of 6.2 (Medium) (Red Hat CVE, Github Advisory).

The root cause is an integer overflow (CWE-122: Heap-based Buffer Overflow) in p11_rpc_message_get_attribute_array_value() within p11-kit/rpc-message.c. The count field is read directly from the RPC payload and multiplied by sizeof(CK_ATTRIBUTE) (12 bytes on 32-bit) without overflow protection; on ILP32 builds, a crafted count value such as 0x15555556 (357,913,942) causes the multiplication to wrap to a small value (e.g., 8 bytes), leading to under-allocation. During a second decode pass in p11_rpc_message_get_attribute(), the code writes at least one full CK_ATTRIBUTE entry (12 bytes) into the undersized buffer, producing a heap out-of-bounds write. Exploitation requires the ability to deliver crafted RPC messages targeting nested attribute types CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, or CKA_DERIVE_TEMPLATE to a p11-kit RPC parser running on an ILP32 build (Red Hat Bugzilla).

Successful exploitation crashes the p11-kit RPC parsing process, resulting in a Denial of Service. There is no established confidentiality or integrity impact — the demonstrated effect is limited to memory corruption causing a process crash. The vulnerability scope is constrained to 32-bit ILP32 deployments where the RPC endpoint is reachable by an attacker, limiting its overall blast radius (Red Hat CVE, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Red Hat CVE). The EPSS score is approximately 0.107%, placing it in the 1st percentile for exploitation likelihood within 30 days (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is further constrained by the requirement for an ILP32 (32-bit) build and access to the p11-kit RPC channel, and the NVD SSVC assessment classifies it as non-automatable with no known exploitation (Red Hat Bugzilla).

1. Identify target: Locate a system running a 32-bit (ILP32) build of p11-kit (e.g., p11-kit-0.26.2-1.el10 on a 32-bit RHEL 10 system) with an accessible RPC channel.
2. Gain RPC channel access: Obtain local access or equivalent access to the p11-kit RPC endpoint (e.g., via a local user account or a network-exposed RPC socket).
3. Craft malicious RPC message: Construct an RPC message containing a nested template attribute of type CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, or CKA_DERIVE_TEMPLATE with validity = 1.
4. Set overflow parameters: Set the outer serialized length to 8 bytes, and encode the nested attribute-array header with count = 357913942 (0x15555556) — a value for which count * sizeof(CK_ATTRIBUTE) (count × 12) wraps to 8 on 32-bit CK_ULONG.
5. Append nested attribute: Append one minimal valid nested attribute record so the second decode pass begins writing a full CK_ATTRIBUTE (12 bytes) into the 8-byte buffer.
6. Trigger crash: Feed the crafted message through the RPC parse path reaching p11_rpc_message_get_attribute(), causing a heap out-of-bounds write and crashing the p11-kit RPC parsing process (Red Hat Bugzilla).

• Process: Unexpected crash or restart of the p11-kit RPC server process (p11-kit server or related daemon) on 32-bit systems.
• Logs: Crash reports or core dumps from the p11-kit process; AddressSanitizer heap-buffer-overflow reports in system logs if the binary was compiled with ASAN; kernel messages indicating segmentation faults from the p11-kit process.
• Network/Socket: Unusual or malformed messages arriving on the p11-kit RPC socket (typically a Unix domain socket), particularly those containing nested attribute arrays with anomalously large count values in CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, or CKA_DERIVE_TEMPLATE attributes (Red Hat Bugzilla).

Red Hat has acknowledged the vulnerability and a patch is tracked via Bugzilla (Bug 2478995); the proposed fix adds overflow checks before the nested attribute-array size calculation and re-validates the second decode pass against the original outer length. Red Hat notes that no currently available mitigation meets their deployment criteria, so upgrading to a fixed package version is the recommended action once available. As a workaround, restrict access to the p11-kit RPC channel to prevent untrusted actors from supplying crafted RPC messages, and avoid ILP32 builds for deployments that expose this RPC parsing path — migrating to 64-bit systems eliminates the vulnerability entirely (Red Hat CVE, Red Hat Bugzilla).

The vulnerability was discovered by AISLE Research in partnership with Red Hat and reported through Red Hat's coordinated disclosure process (Red Hat CVE). Coverage has appeared on Linux security news aggregators including LinuxSecurity.com and pro-linux.de, as well as Slackware changelogs indicating distribution-level awareness. No significant social media discussion or notable researcher commentary beyond the initial disclosure has been observed.