CVE-2026-50593: Graphite before 1

Synopsis

An integer underflow leading to an out-of-bounds write affects Graphite versions before 1.3.15. The flaw is triggered locally and requires a user to interact with a malicious file or input, but no authentication is needed. Successful exploitation gives an attacker the ability to corrupt memory, tamper with data, and crash the affected process, with potential for arbitrary code execution. A patched-image rebuild at version 1.3.15 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network exposure is required to trigger the vulnerability.

• AuthenticationNot required

  No account or credentials are required; the attacker can trigger the flaw without authenticating to any service.

• Victim interactionRequired

  A user on the target system must open or process a crafted file or input that exercises the vulnerable Graphite code path.

• Attack complexityDetail

  The exploit is reliable and condition-free once the victim interacts with the malicious input; no race conditions or special environment configuration are needed.

Blast Radius

• Writes arbitrary data outside the intended slot-map buffer, corrupting adjacent memory regions.
• Modifies or destroys data held in the affected process, including any in-memory state being processed at the time.
• Crashes the affected application or service, causing a denial of service for any workload depending on Graphite rendering.
• In the worst case, controlled out-of-bounds writes can be leveraged to redirect execution flow and run attacker-supplied code within the process context.