CVE-2026-75476 in Threat Response
Summary
by MITRE • 08/20/2026
Tanium addressed a compression bomb vulnerability in Threat Response.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/20/2026
The discovery of a compression bomb vulnerability within Tanium's Threat Response module highlights significant risks associated with the processing of untrusted or potentially malicious input data during archive extraction operations. This type of flaw, commonly referred to as a zip slip or decompression bomb attack, exploits the fundamental mechanics of lossless compression algorithms where a small compressed file can expand into an excessively large amount of uncompressed data. In this specific instance, the vulnerability likely stemmed from insufficient validation checks on the metadata contained within archive files before they were processed by the application's internal parsers. When Threat Response ingests evidence or logs for analysis, it must decompress various formats to inspect their contents. If the software fails to verify that the ratio between compressed and uncompressed sizes remains within acceptable bounds, an attacker can craft a maliciously constructed file designed to consume excessive system resources upon extraction.
From a technical perspective, this vulnerability aligns with CWE-409, which describes the improper handling of highly compressed data in input decoding algorithms. The core issue lies not necessarily in the decompression library itself but in the application logic that governs how much memory or disk space is allocated for the expansion process without prior size verification. By submitting a file containing high entropy data with minimal compression ratios, an attacker can trigger a denial of service condition. This results in rapid exhaustion of available RAM or CPU cycles as the system attempts to expand the payload beyond its intended limits. In enterprise environments where Tanium operates at scale, such resource exhaustion could impact not only the specific endpoint running the Threat Response agent but potentially affect broader visibility and monitoring capabilities if the central server is also involved in processing these malformed inputs during ingestion workflows.
The operational impact of this vulnerability extends beyond simple service disruption. A successful exploitation could lead to a denial of service that blinds security teams to ongoing threats, effectively creating an opportunity for adversaries to operate undetected within the network. Furthermore, depending on the specific implementation details and privilege levels associated with the Threat Response process, there may be secondary risks involving arbitrary code execution if memory corruption occurs during the overflow conditions induced by excessive data expansion. This scenario underscores the critical importance of input validation in security tools that handle diverse file types from potentially compromised endpoints. The ability to crash or degrade the performance of a primary defense mechanism represents a severe compromise of availability, which is one of the three pillars of information security alongside confidentiality and integrity.
To mitigate this risk, Tanium implemented fixes that enforce strict limits on decompression operations. These mitigations typically involve implementing checks for both the uncompressed size relative to the compressed size and absolute maximum file sizes allowed during extraction processes. Security architects should ensure their environments are updated with these patches immediately to restore full operational resilience against such attacks. Additionally, defense-in-depth strategies recommend configuring operating system level resource controls, such as memory limits or CPU throttling via cgroups on Linux systems, to contain the blast radius of any potential exploitation attempts. Regular auditing of third-party components and adherence to secure coding standards that prioritize input validation are essential practices for preventing similar vulnerabilities in future software development cycles aligned with industry frameworks like CWE-409 and ATT&CK techniques related to resource hijacking or denial of service.