{"id":"CVE-2026-108307","kind":"vulnerability","aliases":["CVE-2026-108307"],"related":[],"title":"Tanium Index: heap buffer overflow in an unspecified component","description":"Tanium addressed a heap-based buffer overflow vulnerability in Index.","summary":"Tanium Index has a heap-based buffer overflow that Tanium has addressed in a fix. The sources do not say what input triggers it or what an attacker gains beyond memory corruption.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["heap-overflow","other","self-hosted","tanium","tanium-index"],"not_affected_if":[],"how_to_check":"Unknown. Check Tanium Index version in the Tanium Console against the fixed version in the Tanium advisory (security.tanium.com, published 2026-10-27) once located.","fix":"- Apply the Tanium update that addresses this issue; the sources do not name the fixed version.","status":"open","published_at":"2026-10-27T18:17:32+00:00","first_seen_at":"2026-10-27T18:32:58+00:00","triaged_at":"2026-10-27T18:34:30+00:00","updated_at":"2026-10-27T18:36:41+00:00","category":"other","confidence":0.3,"triage":{"at":"2026-10-27T18:34:30Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Tanium update that addresses this issue; the sources do not name the fixed version.","reach":"unknown","title":"Tanium Index: heap buffer overflow in an unspecified component","impact":"high","summary":"Tanium Index has a heap-based buffer overflow that Tanium has addressed in a fix. The sources do not say what input triggers it or what an attacker gains beyond memory corruption.","category":"other","nicknames":[],"who_cares":["tanium"],"confidence":0.35,"needs_auth":"unknown","worst_case":"unknown; memory corruption in Tanium Index","analyst_note":"Find the Tanium advisory for CVE-2026-108307 to confirm affected and fixed versions, the trigger and required privileges; check https://nvd.nist.gov/vuln/detail/CVE-2026-108307.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00051,"input_tokens":3232,"output_tokens":374,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Tanium advisory for CVE-2026-108307 to confirm affected and fixed versions, the trigger and required privileges; check https://nvd.nist.gov/vuln/detail/CVE-2026-108307.","search":"'-108307':12A,15A '-2026':11A,14A 'address':39B,61C 'attack':55B 'base':33B,65C 'beyond':57B 'buffer':4A,34B,66C 'compon':9A 'corrupt':59B 'cve':10A,13A 'fix':42B 'gain':56B 'heap':3A,17B,32B,64C 'heap-bas':31B,63C 'heap-overflow':16B 'host':22B 'index':2A,26B,28B,70C 'input':49B 'memori':58B 'overflow':5A,18B,35B,67C 'say':47B 'self':21B 'self-host':20B 'sourc':44B 'tanium':1A,23B,25B,27B,37B,60C 'tanium-index':24B 'trigger':50B 'unspecifi':8A 'vulner':68C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T18:17:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"3938794e-25f5-4123-a1ba-5cbd7f104512","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108307","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108307","severity":null,"published_at":"2026-10-27T18:17:32+00:00","modified_at":"2026-10-27T18:17:32+00:00","first_seen_at":"2026-10-27T18:32:58+00:00","fetched_at":"2026-10-27T18:32:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-108307:916","url":null,"severity":null,"published_at":"2026-10-27T18:36:41+00:00","modified_at":"2026-10-27T18:36:41+00:00","first_seen_at":"2026-10-27T18:36:41+00:00","fetched_at":"2026-10-27T18:36:41+00:00","note":"Could not find Tanium's own advisory for this CVE: NVD page returned empty, security.tanium.com index lists Oct 27 2026 entries without titles or links, searches found only unrelated TAN advisories. Versions, trigger and privileges remain unknown. Nothing verified. Check security.tanium.com for the Index advisory dated 2026-10-27 or the NVD references."}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}