CVE-2026-26011

{"id": "CVE-2026-26011", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2026-02-12T21:16:03.340", "references": [{"url": "https://github.com/ros-navigation/navigation2/commit/d09ea82477ce9234678a6febf6890235e0a7ce12", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ros-navigation/navigation2/releases/tag/1.3.11", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ros-navigation/navigation2/security/advisories/GHSA-mgj5-g2p6-gc5x", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ros-navigation/navigation2/security/advisories/GHSA-mgj5-g2p6-gc5x", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-122"}, {"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "navigation2 is a ROS 2 Navigation Framework and System. In 1.3.11 and earlier, a critical heap out-of-bounds write vulnerability exists in Nav2 AMCL's particle filter clustering logic. By publishing a single crafted geometry_msgs/PoseWithCovarianceStamped message with extreme covariance values to the /initialpose topic, an unauthenticated attacker on the same ROS 2 DDS domain can trigger a negative index write (set->clusters[-1]) into heap memory preceding the allocated buffer. In Release builds, the sole boundary check (assert) is compiled out, leaving zero runtime protection. This primitive allows controlled corruption of the heap chunk metadata(at least the size of the heap chunk where the set->clusters is in is controllable by the attacker), potentially leading to further exploitation. At minimum, it provides a reliable single-packet denial of service that kills localization and halts all navigation."}, {"lang": "es", "value": "navigation2 es un Framework y Sistema de Navegaci\u00f3n de ROS 2. En 1.3.11 y versiones anteriores, existe una vulnerabilidad cr\u00edtica de escritura fuera de l\u00edmites en el heap en la l\u00f3gica de agrupamiento del filtro de part\u00edculas de Nav2 AMCL. Al publicar un \u00fanico mensaje manipulado geometry_msgs/PoseWithCovarianceStamped con valores de covarianza extremos en el tema /initialpose, un atacante no autenticado en el mismo dominio DDS de ROS 2 puede desencadenar una escritura de \u00edndice negativo (set->clusters[-1]) en la memoria del heap que precede al b\u00fafer asignado. En las compilaciones de lanzamiento, la \u00fanica comprobaci\u00f3n de l\u00edmites (assert) se elimina en la compilaci\u00f3n, dejando cero protecci\u00f3n en tiempo de ejecuci\u00f3n. Esta primitiva permite la corrupci\u00f3n controlada de los metadatos del fragmento del heap (al menos el tama\u00f1o del fragmento del heap donde se encuentra set->clusters es controlable por el atacante), lo que podr\u00eda conducir a una explotaci\u00f3n posterior. Como m\u00ednimo, proporciona una denegaci\u00f3n de servicio fiable de un solo paquete que detiene la localizaci\u00f3n y toda la navegaci\u00f3n."}], "lastModified": "2026-02-23T17:00:05.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:opennav:nav2:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2D42D969-E358-4720-94FB-BE2112F7F424", "versionEndIncluding": "1.3.11"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}