Out-of-Bounds Memory Read Vulnerability in Hivex Affects Red Hat Products
CVE-2026-120740

2LOW

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Vendor
CVE Published:
2 November 2026

What is CVE-2026-120740?

A vulnerability in Hivex can be exploited by an attacker through specially crafted Windows registry hive files. Maliciously formatted large data block lists can lead to an out-of-bounds memory read during the parsing of these registry values, potentially causing the application to crash. This flaw makes affected applications susceptible to Denial of Service attacks, leaving systems temporarily inoperative and causing disruption. It is crucial for users of Hivex to update to the latest version to mitigate these risks.

References

https://access.redhat.com/security/cve/CVE-2026-120740
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2565405
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
2
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Nguyen Dinh Hai (github.com/Haind03) for reporting this issue.
.