---
id: "CVE-2026-108307"
kind: "vulnerability"
aliases: ["CVE-2026-108307"]
title: "Tanium Index: heap buffer overflow in an unspecified component"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["heap-overflow", "other", "self-hosted", "tanium", "tanium-index"]
not_affected_if: []
published_at: "2026-10-27T18:17:32+00:00"
first_seen_at: "2026-10-27T18:32:58+00:00"
updated_at: "2026-10-27T18:36:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108307", "first_seen_at": "2026-10-27T18:32:58+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-27T18:36:41+00:00"}]
---

# Tanium Index: heap buffer overflow in an unspecified component

Tanium Index has a heap-based buffer overflow that Tanium has addressed in a fix. The sources do not say what input triggers it or what an attacker gains beyond memory corruption.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Unknown. Check Tanium Index version in the Tanium Console against the fixed version in the Tanium advisory (security.tanium.com, published 2026-10-27) once located.

## Fix

- Apply the Tanium update that addresses this issue; the sources do not name the fixed version.

## Timeline

- 2026-10-27T18:32:58+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-108307
- 2026-10-27T18:36:41+00:00 analyst — Could not find Tanium's own advisory for this CVE: NVD page returned empty, security.tanium.com index lists Oct 27 2026 entries without titles or links, searches found only unrelated TAN advisories. Versions, trigger and privileges remain unknown. Nothing verified. Check security.tanium.com for the Index advisory dated 2026-10-27 or the NVD references.

## From the sources

Tanium addressed a heap-based buffer overflow vulnerability in Index.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_