open-telemetry opentelemetry-ebpf-instrumentation up to 0.8.x iov_iter.count buffer over-read

Summaryinfo

A vulnerability, which was classified as problematic, was found in open-telemetry opentelemetry-ebpf-instrumentation up to 0.8.x. This impacts an unknown function. The manipulation of the argument iov_iter.count results in buffer over-read. This vulnerability is reported as CVE-2026-45684. The attack requires a local approach. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in open-telemetry opentelemetry-ebpf-instrumentation up to 0.8.x. Affected is some unknown functionality. The manipulation of the argument iov_iter.count with an unknown input leads to a buffer over-read vulnerability. CWE is classifying the issue as CWE-126. The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From version 0.7.0 to before version 0.9.0, OBI's log enricher mishandles writev buffers by reading only the first iovec entry but using the total iov_iter.count as the copy length. When log injection is enabled, a crafted multi-segment writev call can make OBI read and overwrite memory beyond the first segment. This issue has been patched in version 0.9.0.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-45684 since 05/12/2026. The exploitability is told to be difficult. The attack needs to be approached locally. There are known technical details, but no exploit is available.

Upgrading to version 0.9.0 eliminates this vulnerability. The upgrade is hosted for download at github.com.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• open-telemetry

Name

• opentelemetry-ebpf-instrumentation

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8

Website

• Product: https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion