CVE-2026-3437

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-3437
An improper restriction of operations within the bounds of a memory buffer vulnerability in Portwell Engineering Toolkits version 4.8.2 could allow a local authenticated attacker to read and write to arbitrary memory via the Portwell Engineering Toolkits driver. Successful exploitation of this vulnerability could result in escalation of privileges or cause a denial-of-service condition.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.0 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-062-04.json
https://software.portwell.tw/security-advisory/PWS-2026-3437.html
https://www.cisa.gov/news-events/ics-advisories/icsa-26-062-04 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:portwell:engineering_toolkits:4.8.2:*:*:*:*:*:*:*
History

25 Jun 2026, 16:16

Type Values Removed Values Added
Summary (en) An Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Portwell Engineering Toolkits version 4.8.2 could allow a local authenticated attacker to read and write to arbitrary memory via the Portwell Engineering Toolkits driver. Successful exploitation of this vulnerability could result in escalation of privileges or cause a denial-of-service condition. (en) An improper restriction of operations within the bounds of a memory buffer vulnerability in Portwell Engineering Toolkits version 4.8.2 could allow a local authenticated attacker to read and write to arbitrary memory via the Portwell Engineering Toolkits driver. Successful exploitation of this vulnerability could result in escalation of privileges or cause a denial-of-service condition.
References
  • () https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-062-04.json -
  • () https://software.portwell.tw/security-advisory/PWS-2026-3437.html -
CVSS v2 : unknown
v3 : 7.8 		v2 : unknown
v3 : 8.8

17 Jun 2026, 10:43

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad de Restricción Inadecuada de Operaciones dentro de los Límites de un Búfer de Memoria en Portwell Engineering Toolkits versión 4.8.2 podría permitir a un atacante local autenticado leer y escribir en memoria arbitraria a través del controlador de Portwell Engineering Toolkits. La explotación exitosa de esta vulnerabilidad podría resultar en escalada de privilegios o causar una condición de denegación de servicio.

05 Mar 2026, 21:38

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
First Time Portwell
Portwell engineering Toolkits
References () https://www.cisa.gov/news-events/ics-advisories/icsa-26-062-04 - () https://www.cisa.gov/news-events/ics-advisories/icsa-26-062-04 - Third Party Advisory, VDB Entry
CPE cpe:2.3:a:portwell:engineering_toolkits:4.8.2:*:*:*:*:*:*:*

03 Mar 2026, 18:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-03 18:16

Updated : 2026-06-25 16:16

NVD link : CVE-2026-3437

Mitre link : CVE-2026-3437

CVE.ORG link : CVE-2026-3437

JSON object : View

Products Affected

portwell

  • engineering_toolkits
CWE
CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer