mcdope pam_usb up to 0.9.0 on Linux src/conf.c xmalloc heap-based overflow

Summaryinfo

A vulnerability has been found in mcdope pam_usb up to 0.9.0 on Linux and classified as critical. This vulnerability affects the function xmalloc of the file src/conf.c. This manipulation causes heap-based overflow. This vulnerability appears as CVE-2026-48065. The attack requires local access. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in mcdope pam_usb up to 0.9.0 on Linux. It has been declared as critical. Affected by this vulnerability is the function xmalloc of the file src/conf.c. The manipulation with an unknown input leads to a heap-based overflow vulnerability. The CWE definition for the vulnerability is CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.1, src/conf.c allocates heap memory proportional to n_devices, a count derived from libxml2 XPath evaluation of the config file, without first enforcing an upper bound. On 32-bit targets (armv7l, i686 -- both listed in the project Makefile), the multiplication n_devices * sizeof(t_pusb_device) wraps around size_t, causing xmalloc() to receive a very small size. Because xmalloc() only calls abort() on NULL return, a small-but-non-NULL allocation is accepted, and subsequent array writes overflow the heap. This vulnerability is fixed in 0.9.1.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-48065 since 05/20/2026. The exploitation appears to be easy. Attacking locally is a requirement. Additional levels of successful authentication are necessary for exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 0.9.1 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• mcdope

Name

• pam_usb

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9.0

Website

• Product: https://github.com/mcdope/pam_usb/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion