Medium severity · published Oct 1, 2026
CVE-2026-79900
Heap overflow in KSL checksum initialization
6.5
CVSS
0.2%
EPSS
No
On KEV
Description
boks_ksllogsd accepts a checksum algorithm name in the MD field of an authenticated KSL start message. Affected releases verify that OpenSSL recognizes the digest name but do not verify that the value fits in a fixed 16-byte checksum context field before copying it. An authenticated KSL client can supply an oversized, OpenSSL-recognized digest name and write beyond the end of the heap allocation.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BM
BoKS Manager boks-server · Fortra
before 8.1.0.24; before 9.0.0.7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-79900
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-79900
www.fortra.com
https://www.fortra.com/security/advisories/product-security/fi-2026-013
More from BoKS Manager boks-server
9.9
CVE-2026-79901
Predictable Active Directory service-account passwords in BoKS Manager