CVE-2026-50593

EUVD-2026-34784
Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds write via Graphite actions, because slotat does not ensure that an offset is within the allowed slot-map range.
Wrap or Wraparound
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
mitreCNA
7.3 HIGH
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 1%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
graphite_projectgraphite
𝑥
< 1.3.15
CNA
Debian logo
Debian Releases
Debian Product
Codename
graphite2
bookworm
1.3.14-1+deb12u1
fixed
bullseye
postponed
forky
1.3.15-2
fixed
sid
1.3.15-2
fixed
trixie
1.3.14-2+deb13u1
fixed
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
graphite2-devel
suse enterprise desktop 15 SP7
1.3.14-150600.3.3.1
fixed
suse enterprise sap 15 SP4
1.3.11-150000.4.6.1
fixed
suse enterprise sap 15 SP5
1.3.11-150000.4.6.1
fixed
suse enterprise sap 15 SP7
1.3.14-150600.3.3.1
fixed
suse enterprise server 12 SP5
1.3.1-10.6.1
fixed
suse enterprise server 15 SP4
1.3.11-150000.4.6.1
fixed
suse enterprise server 15 SP5
1.3.11-150000.4.6.1
fixed
suse enterprise server 15 SP6
1.3.14-150600.3.3.1
fixed
suse enterprise server 15 SP7
1.3.14-150600.3.3.1
fixed
libgraphite2-3
suse enterprise desktop 15 SP7
1.3.14-150600.3.3.1
fixed
suse enterprise sap 15 SP4
1.3.11-150000.4.6.1
fixed
suse enterprise sap 15 SP5
1.3.11-150000.4.6.1
fixed
suse enterprise sap 15 SP7
1.3.14-150600.3.3.1
fixed
suse enterprise server 12 SP3
1.3.1-10.6.1
fixed
suse enterprise server 12 SP5
1.3.1-10.6.1
fixed
suse enterprise server 15 SP4
1.3.11-150000.4.6.1
fixed
suse enterprise server 15 SP5
1.3.11-150000.4.6.1
fixed
suse enterprise server 15 SP6
1.3.14-150600.3.3.1
fixed
suse enterprise server 15 SP7
1.3.14-150600.3.3.1
fixed
libgraphite2-3-32bit
suse enterprise desktop 15 SP7
1.3.14-150600.3.3.1
fixed
suse enterprise sap 15 SP4
1.3.11-150000.4.6.1
fixed
suse enterprise sap 15 SP5
1.3.11-150000.4.6.1
fixed
suse enterprise sap 15 SP7
1.3.14-150600.3.3.1
fixed
suse enterprise server 12 SP3
1.3.1-10.6.1
fixed
suse enterprise server 12 SP5
1.3.1-10.6.1
fixed
suse enterprise server 15 SP4
1.3.11-150000.4.6.1
fixed
suse enterprise server 15 SP5
1.3.11-150000.4.6.1
fixed
suse enterprise server 15 SP6
1.3.14-150600.3.3.1
fixed
suse enterprise server 15 SP7
1.3.14-150600.3.3.1
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
graphite2
Amazon Linux 2
0:1.3.10-1.amzn2.0.3
fixed
Amazon Linux 2023
0:1.3.14-7.amzn2023.0.3
fixed
graphite2-debuginfo
Amazon Linux 2
0:1.3.10-1.amzn2.0.3
fixed
Amazon Linux 2023
0:1.3.14-7.amzn2023.0.3
fixed
graphite2-debugsource
Amazon Linux 2023
0:1.3.14-7.amzn2023.0.3
fixed
graphite2-devel
Amazon Linux 2
0:1.3.10-1.amzn2.0.3
fixed
Amazon Linux 2023
0:1.3.14-7.amzn2023.0.3
fixed
Common Weakness Enumeration
References
https://github.com/silnrsi/graphite/commit/ad78c6b7319909e1540c1b134e115ced03417866
https://github.com/silnrsi/graphite/compare/1.3.14...1.3.15