Externally-Controlled Format String Vulnerability in iSulad by openEuler
CVE-2026-111434

5.6MEDIUM

Key Information:

Vendor

Openeuler

Status
Isulad
Vendor
CVE Published:
12 November 2026

What is CVE-2026-111434?

The vulnerability in iSulad occurs when the daemon interacts with the isula runtime for managing container lifecycle operations. By reading error messages from the shim process, the daemon may inadvertently process format specifiers in stderr output. This could lead to unintended consequences, such as information leakage or arbitrary write operations, posing a serious risk during container management tasks.

Affected Version(s)

iSulad Linux 0 <= 2.1.6

References

https://atomgit.com/openeuler/iSulad/commit/697cb26a5946d...
patch
https://atomgit.com/src-openeuler/iSulad/pull/812
patch

CVSS V3.1

Score:
5.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Fengyi Wang
.