How severe is CVE-2023-26607?

CVE-2023-26607 has a CVSS 3.x base score of 7.1, rated high severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability high.

Is CVE-2023-26607 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (45th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2023-26607?

CVE-2023-26607 primarily affects Netapp Hci Baseboard Management Controller. In total, 6 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2023-26607?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2023-26607 published?

CVE-2023-26607 was published on 2023-02-26 and last updated on 2026-06-17.

CVE-2023-26607

CVE-2023-26607 is a high-severity vulnerability in Netapp Hci Baseboard Management Controller with a CVSS 3.x base score of 7.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-125.

Key facts

Severity: High (CVSS 3.x base score 7.1)
EPSS exploit prediction: 1% (45th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-125
Affected product: Netapp Hci Baseboard Management Controller
Published: 2023-02-26
Last modified: 2026-06-17

Description

In the Linux kernel 6.0.8, there is an out-of-bounds read in ntfs_attr_find in fs/ntfs/attrib.c.

Frequently asked questions

What is CVE-2023-26607?: In the Linux kernel 6.0.8, there is an out-of-bounds read in ntfs_attr_find in fs/ntfs/attrib.c.
How severe is CVE-2023-26607?: CVE-2023-26607 has a CVSS 3.x base score of 7.1, rated high severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability high.
Is CVE-2023-26607 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (45th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2023-26607?: CVE-2023-26607 primarily affects Netapp Hci Baseboard Management Controller. In total, 6 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2023-26607?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2023-26607 published?: CVE-2023-26607 was published on 2023-02-26 and last updated on 2026-06-17.

References

Affected products (6)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:a:netapp:hci_baseboard_management_controller:h300s:*:*:*:*:*:*:*
cpe:2.3:a:netapp:hci_baseboard_management_controller:h410c:*:*:*:*:*:*:*
cpe:2.3:a:netapp:hci_baseboard_management_controller:h410s:*:*:*:*:*:*:*
cpe:2.3:a:netapp:hci_baseboard_management_controller:h500s:*:*:*:*:*:*:*
cpe:2.3:a:netapp:hci_baseboard_management_controller:h700s:*:*:*:*:*:*:*

More vulnerabilities in Netapp Hci Baseboard Management Controller

CVE-2021-4154 — High (CVSS 8.8): A use-after-free flaw was found in cgroup1_parse_param in kernel/cgroup/cgroup-v1.c in the Linux kernel's cgroup v1…
CVE-2021-45960 — High (CVSS 8.8): In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can…
CVE-2021-46143 — High (CVSS 8.1): In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.
CVE-2023-2598 — High (CVSS 7.8): A flaw was found in the fixed buffer registration code for io_uring (io_sqe_buffer_register in io_uring/rsrc.c) in the…
CVE-2023-32233 — High (CVSS 7.8): In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused…
CVE-2023-2236 — High (CVSS 7.8): A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local privilege…

All CVEs affecting Netapp Hci Baseboard Management Controller →

Other CWE-125 (Out-of-bounds Read) vulnerabilities

CVE-2026-24826 — Critical (CVSS 10.0): Out-of-bounds Write, Divide By Zero, NULL Pointer Dereference, Use of Uninitialized Resource, Out-of-bounds Read,…
CVE-2024-22004 — Critical (CVSS 10.0): Due to length check, an attacker with privilege access on a Linux Nonsecure operating system can trigger a…
CVE-2021-41556 — Critical (CVSS 10.0): sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read (in the core interpreter) that…
CVE-2021-21777 — Critical (CVSS 10.0): An information disclosure vulnerability exists in the Ethernet/IP UDP handler functionality of EIP Stack Group OpENer…
CVE-2017-14451 — Critical (CVSS 10.0): An exploitable out-of-bounds read vulnerability exists in libevm (Ethereum Virtual Machine) of CPP-Ethereum. A…
CVE-2013-0767 — Critical (CVSS 10.0): The nsSVGPathElement::GetPathLengthScale function in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and…

Browse all CWE-125 (Out-of-bounds Read) vulnerabilities →