{"id":"CVE-2026-111434","kind":"vulnerability","aliases":["CVE-2026-111434"],"related":[],"title":"iSulad: format string flaw in shim stderr handling risks leaks and crashes","description":"Use of Externally-Controlled format string vulnerability in openEuler iSulad on Linux.\n\nThis vulnerability is associated with program file src/daemon/modules/image/oci/oci_load.c.\n\n\n\nThis issue affects iSulad: through 2.1.6.\n\n\n\nWhen the iSulad daemon performs container lifecycle operations (such as create, start, exec, stop, etc.) through the isula runtime (shim), the daemon reads the stderr output of the shim process via a pipe for error information display. If the buffer contains format specifiers such as %s, %x, or %n, it may trigger a format string vulnerability, potentially leading to information leakage, denial of service, or the risk of arbitrary writes.","summary":"The iSulad container daemon passes error text read from the isula shim's stderr pipe into a format function without a fixed format string. An attacker who can make the shim output format specifiers can leak memory contents, crash the daemon, or possibly perform arbitrary writes.","severity":"medium","cvss":5.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"iSulad","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["containers","isulad","linux","openeuler","runtime"],"not_affected_if":["not-using-isulad"],"how_to_check":"- Check the installed iSulad version with `isula version` or the package manager, and compare it with the affected range through 2.1.6.\n- Confirm whether the daemon runs container lifecycle operations through the isula runtime (shim) on the host.","fix":null,"status":"open","published_at":"2026-11-12T04:17:17+00:00","first_seen_at":"2026-11-12T04:47:08+00:00","triaged_at":"2026-11-12T04:47:53+00:00","updated_at":"2026-11-12T04:47:53+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-12T04:47:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"iSulad: format string flaw in shim stderr handling risks leaks and crashes","impact":"medium","summary":"The iSulad container daemon passes error text read from the isula shim's stderr pipe into a format function without a fixed format string. An attacker who can make the shim output format specifiers can leak memory contents, crash the daemon, or possibly perform arbitrary writes.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["isulad","openeuler","containers","linux"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Daemon memory leaks, crashes, or possible arbitrary writes on the host","analyst_note":"Find the fixed iSulad version and any patch in the openEuler advisory or the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-111434); the sources give only 'through 2.1.6'.","how_to_check":"- Check the installed iSulad version with `isula version` or the package manager, and compare it with the affected range through 2.1.6.\n- Confirm whether the daemon runs container lifecycle operations through the isula runtime (shim) on the host.","plain_action":"","product_name":"iSulad","needs_analyst":true,"not_affected_if":["not-using-isulad"],"who_is_affected":"Hosts running the openEuler iSulad container daemon with the isula runtime shim, where container create, start, exec or stop operations are performed. Sources do not state which shim outputs can be influenced by an attacker, so exposure depends on whether untrusted input can reach the shim's stderr. Teams not running iSulad can skip it.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000785,"input_tokens":4673,"output_tokens":635,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111434':15A,18A '-2026':14A,17A '2.1.6':97C 'affect':94C 'arbitrari':69B,166C 'associ':87C 'attack':50B 'buffer':137C 'contain':20B,27B,103C,138C 'content':62B 'control':75C 'crash':12A,63B 'creat':108C 'cve':13A,16A 'daemon':28B,65B,101C,119C 'denial':159C 'display':134C 'error':30B,132C 'etc':112C 'exec':110C 'extern':74C 'externally-control':73C 'file':90C 'fix':46B 'flaw':4A 'format':2A,42B,47B,57B,76C,139C,151C 'function':43B 'handl':8A 'inform':133C,157C 'issu':93C 'isula':35B,115C 'isulad':1A,19A,21B,26B,81C,95C,100C 'lead':155C 'leak':10A,60B 'leakag':158C 'lifecycl':104C 'linux':22B,83C 'make':53B 'may':148C 'memori':61B 'n':146C 'openeul':23B,80C 'oper':105C 'output':56B,123C 'pass':29B 'perform':68B,102C 'pipe':39B,130C 'possibl':67B 'potenti':154C 'process':127C 'program':89C 'read':32B,120C 'risk':9A,164C 'runtim':24B,116C 'servic':161C 'shim':6A,36B,55B,117C,126C 'specifi':58B,140C 'src/daemon/modules/image/oci/oci_load.c':91C 'start':109C 'stderr':7A,38B,122C 'stop':111C 'string':3A,48B,77C,152C 'text':31B 'trigger':149C 'use':71C 'via':128C 'vulner':78C,85C,153C 'without':44B 'write':70B,167C 'x':144C","nicknames":[],"mitigations":[],"who_affected":"Hosts running the openEuler iSulad container daemon with the isula runtime shim, where container create, start, exec or stop operations are performed. Sources do not state which shim outputs can be influenced by an attacker, so exposure depends on whether untrusted input can reach the shim's stderr. Teams not running iSulad can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["isulad"],"ptokens":["isulad"],"labels":["containers","isulad","linux","medium","openeuler","runtime","vendor"],"campaign_type":null,"search_a":"'-111434':15A,18A '-2026':14A,17A 'crash':12A 'cve':13A,16A 'flaw':4A 'format':2A 'handl':8A 'isulad':1A,19A 'leak':10A 'risk':9A 'shim':6A 'stderr':7A 'string':3A","search_b":"'arbitrari':69B 'attack':50B 'contain':20B,27B 'content':62B 'crash':63B 'daemon':28B,65B 'error':30B 'fix':46B 'format':42B,47B,57B 'function':43B 'isula':35B 'isulad':21B,26B 'leak':60B 'linux':22B 'make':53B 'memori':61B 'openeul':23B 'output':56B 'pass':29B 'perform':68B 'pipe':39B 'possibl':67B 'read':32B 'runtim':24B 'shim':36B,55B 'specifi':58B 'stderr':38B 'string':48B 'text':31B 'without':44B 'write':70B","search_c":"'2.1.6':97C 'affect':94C 'arbitrari':166C 'associ':87C 'buffer':137C 'contain':103C,138C 'control':75C 'creat':108C 'daemon':101C,119C 'denial':159C 'display':134C 'error':132C 'etc':112C 'exec':110C 'extern':74C 'externally-control':73C 'file':90C 'format':76C,139C,151C 'inform':133C,157C 'issu':93C 'isula':115C 'isulad':81C,95C,100C 'lead':155C 'leakag':158C 'lifecycl':104C 'linux':83C 'may':148C 'n':146C 'openeul':80C 'oper':105C 'output':123C 'perform':102C 'pipe':130C 'potenti':154C 'process':127C 'program':89C 'read':120C 'risk':164C 'runtim':116C 'servic':161C 'shim':117C,126C 'specifi':140C 'src/daemon/modules/image/oci/oci_load.c':91C 'start':109C 'stderr':122C 'stop':111C 'string':77C,152C 'trigger':149C 'use':71C 'via':128C 'vulner':78C,85C,153C 'write':167C 'x':144C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T04:17:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H","cvss_by":"securities@openeuler.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111434","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111434","severity":null,"published_at":"2026-11-12T04:17:17+00:00","modified_at":"2026-11-12T04:17:17+00:00","first_seen_at":"2026-11-12T04:47:08+00:00","fetched_at":"2026-11-12T04:47:08+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}