Parser State Isolation Vulnerability in MISP-STIX Affecting Threat Intelligence Integrity

CVE-2026-77761

What is CVE-2026-77761?

A parser state isolation vulnerability in MISP-STIX allows for potential data retention from previously processed STIX documents if a single parser instance is reused across multiple independent documents. This issue arises due to incomplete clearing of per-document state in STIX parsers, resulting in retained information such as galaxy details, references, and timestamps. Consequently, when parsing new STIX packages, an attacker could inadvertently cause a MISP event to incorporate data from previous documents, which may lead to incorrect associations and misleading context in threat intelligence reporting. The risk of information contamination underscores the importance of using separate parser instances for each document to maintain data integrity.

References