CVE-2026-7310

A heap-based buffer overflow vulnerability exists in XML parser functionality in the HiDraw. An authenticated malicious user with local access can exploit this vulnerability using a specially crafted XML file which may lead to memory corruption and potential arbitrary code execution. Successful exploitation could result in application crashes (denial of service) and compromise the confidentiality and integrity of the affected system.

CVSS

No CVSS.

References

Link	Resource
https://publisher.hitachienergy.com/preview?DocumentID=8DBD000248&LanguageCode=en&DocumentPartId=&Action=Launch

Configurations

No configuration.

History

23 Jul 2026, 12:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de desbordamiento de búfer basado en montículo existe en la funcionalidad del analizador XML en HiDraw. Un usuario malicioso autenticado con acceso local puede explotar esta vulnerabilidad utilizando un archivo XML especialmente diseñado, lo que puede conducir a la corrupción de memoria y a una posible ejecución de código arbitrario. Una explotación exitosa podría resultar en caídas de la aplicación (denegación de servicio) y comprometer la confidencialidad y la integridad del sistema afectado.

26 May 2026, 14:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-05-26 14:16

Updated : 2026-07-24 08:10

NVD link : CVE-2026-7310

Mitre link : CVE-2026-7310

CVE.ORG link : CVE-2026-7310

JSON object : View

Products Affected

No product.

CWE

CWE-122

Heap-based Buffer Overflow

{"id": "CVE-2026-7310", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7310", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-26T14:31:07.539083Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cybersecurity@hitachienergy.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cybersecurity@hitachienergy.com", "affectedData": [{"vendor": "Hitachi Energy", "product": "MACH HiDraw", "versions": [{"status": "affected", "version": "9.0", "lessThan": "9.22", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-26T14:16:40.523", "references": [{"url": "https://publisher.hitachienergy.com/preview?DocumentID=8DBD000248&LanguageCode=en&DocumentPartId=&Action=Launch", "source": "cybersecurity@hitachienergy.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cybersecurity@hitachienergy.com", "description": [{"lang": "en", "value": "CWE-122"}]}], "descriptions": [{"lang": "en", "value": "A heap-based buffer overflow vulnerability exists in XML\nparser functionality in the HiDraw. An authenticated\nmalicious user with local access can exploit this\nvulnerability using a specially crafted XML file which may\nlead to memory corruption and potential arbitrary code\nexecution. Successful exploitation could result in\napplication crashes (denial of service) and compromise the\nconfidentiality and integrity of the affected system."}, {"lang": "es", "value": "Una vulnerabilidad de desbordamiento de b\u00fafer basado en mont\u00edculo existe en la funcionalidad del analizador XML en HiDraw. Un usuario malicioso autenticado con acceso local puede explotar esta vulnerabilidad utilizando un archivo XML especialmente dise\u00f1ado, lo que puede conducir a la corrupci\u00f3n de memoria y a una posible ejecuci\u00f3n de c\u00f3digo arbitrario. Una explotaci\u00f3n exitosa podr\u00eda resultar en ca\u00eddas de la aplicaci\u00f3n (denegaci\u00f3n de servicio) y comprometer la confidencialidad y la integridad del sistema afectado."}], "lastModified": "2026-07-24T08:10:00.150", "sourceIdentifier": "cybersecurity@hitachienergy.com"}