CVE-2026-10722

June 4, 2026, 4:37 p.m.

1.9
Low

Description

A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go of the component LoadCollectionSpec/LoadCollectionSpecFromReader. Such manipulation of the argument offset leads to integer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The name of the patch is 533dfc82fd228bfadf42ea7180c39de7d9af47fa. A patch should be applied to remediate this issue.

Product(s) Impacted

Vendor Product Versions
Cilium
  • Ebpf
  • <0.21.0

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-189
None
None

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a cilium ebpf <0.21.0 / / / / / / /

References

https://gist.github.com/thesmartshadow/256bff0f8042c584f993ace89074a815
https://github.com/cilium/ebpf/
https://github.com/cilium/ebpf/commit/533dfc82fd228bfadf42ea7180c39de7d9af47fa
https://github.com/cilium/ebpf/issues/2019
https://github.com/cilium/ebpf/pull/2021
https://vuldb.com/cve/CVE-2026-10722
https://vuldb.com/submit/818291
https://vuldb.com/vuln/368091
https://vuldb.com/vuln/368091/cti

Tags

[email protected]
CWE-189
2026-06-03
CVE-2026-10722

CVSS Score

1.9 / 10

CVSS Data - 4.0

  • Attack Vector: LOCAL
  • Attack Complexity: LOW
  • Attack Requirements: NONE
  • Privileges Required: LOW
  • User Interaction: NONE
  • Scope:
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: LOW
  • Exploit Maturity: PROOF_OF_CONCEPT

    • CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

    View Vector String

Timeline

Published: June 3, 2026, 1:16 p.m.
Last Modified: June 4, 2026, 4:37 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

[email protected]

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.