Use of Externally-Controlled format string vulnerability in openEuler iSulad on Linux.
cve-program · CVE-2026-111434
PublishedUse of Externally-Controlled format string vulnerability in openEuler iSulad on Linux. This vulnerability is associated with program file src/daemon/modules/image/oci/oci_load.c. This issue affects iSulad: through 2.1.6. When the iSulad daemon performs container lifecycle operations (such as create, start, exec, stop, etc.) through the isula runtime (shim), the daemon reads the stderr output of the shim process via a pipe for error information display. If the buffer contains format specifiers such as %s, %x, or %n, it may trigger a format string vulnerability, potentially leading to information leakage, denial of service, or the risk of arbitrary writes.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-111434 · CVE overview and exploitation status
cve-program · CVE-2026-111434
Related changes
Linked by CVE identifier- Use of Externally-Controlled format string vulnerability in openEuler iSulad on Linux. · Newly collected advisory · 12 Nov 2026
- Use of Externally-Controlled format string vulnerability in openEuler iSulad on Linux. · Advisory content revised · 12 Nov 2026