rootpwn

high · CVSS v3 8.8

CVE-2026-88765

A high‑severity buffer overflow in the Unicode conversion wrapper of certain Git hosting platforms allows an authenticated user to upload a

Overview

A high‑severity buffer overflow in the Unicode conversion wrapper of certain Git hosting platforms allows an authenticated user to upload a crafted Git export file that triggers arbitrary remote code execution during Advanced Search indexing. The flaw can lead to full server compromise if exploited.

Description

The vulnerability exists due to a memory safety buffer overflow error residing inside the Unicode text conversion wrapper. An authenticated attacker can submit a heavily manipulated Git project export file to overwrite memory during Advanced Search indexing tasks, achieving full arbitrary remote code execution (RCE) on the server host.

Impact

An attacker who can authenticate to the affected system can gain full control of the server host, compromising confidentiality, integrity, and availability of all hosted repositories and services.

Remediation

['Apply the vendor‑issued patch or upgrade to the latest version that fixes the Unicode conversion buffer overflow.', 'If a patch is not yet available, disable or restrict the Advanced Search indexing feature until remediation.', 'Restrict upload permissions for Git export files to only trusted administrators.', 'Implement strict input validation and memory‑safety checks for all Unicode processing paths.', 'Use least‑privilege principles for authenticated users and monitor for anomalous indexing activity.']

Risk context

The vulnerability has a CVSS v3 score of 8.8 (High) and no EPSS data, indicating a serious risk that requires prompt patching or mitigation.

Affected products

  • GitLab
  • GitHub Enterprise
  • Gitea
  • Gitea Enterprise
  • GitBucket
  • Bitbucket Server
  • Azure DevOps Server
  • Perforce Helix

Scores

Severity
high
CVSS v2
6.5
CVSS v3
8.8
CVSS v4
—
EPSS
—

buffer-overflow unicode memory-safety arbitrary-code-execution authenticated git advanced-search

← All CVEs

Related CVEs

high

CVE-2026-81546

Affinity by Canva versions prior to 3.3.0 are vulnerable to a stack-based buffer overflow when parsing Affinity document files. An attacker can craft a malicious file that, when opened, may allow arbitrary code execution on the victim’s machine.

View analysis

high

CVE-2026-92838

A DLL hijacking flaw in GeoVision GV-Remote E-Map allows a local user with write access to a directory to drop a malicious DLL that is loaded before the legitimate one. If exploited, the attacker can run arbitrary code in the context of the GV-Remote E-Map process, potentially compromising local data and system integrity.

View analysis

high

CVE-2026-92380

A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Remote Image Fetch. This manipulation of the argument source[] causes server-side request forgery. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

View analysis

high

CVE-2026-86445

The LearnPress WordPress plugin (prior to 4.4.7) lacks proper capability checks in an admin template handler, enabling unauthenticated users to read all published quiz questions and perform keyword searches on them. This flaw exposes quiz content that should remain private to site administrators and instructors.

View analysis