---
id: "CVE-2026-111434"
page: "https://infrastack.ai/live/CVE-2026-111434"
kind: "vulnerability"
aliases: ["CVE-2026-111434"]
title: "iSulad: format string flaw in shim stderr handling risks leaks and crashes"
severity: "medium"
cvss: 5.6
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "iSulad", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["containers", "isulad", "linux", "openeuler", "runtime"]
not_affected_if: ["not-using-isulad"]
published_at: "2026-11-12T04:17:17+00:00"
first_seen_at: "2026-11-12T04:47:08+00:00"
updated_at: "2026-11-12T04:47:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111434", "first_seen_at": "2026-11-12T04:47:08+00:00"}]
exploit_sources: []
---

# iSulad: format string flaw in shim stderr handling risks leaks and crashes

Link for people: https://infrastack.ai/live/CVE-2026-111434 (this .md is for agents)

The iSulad container daemon passes error text read from the isula shim's stderr pipe into a format function without a fixed format string. An attacker who can make the shim output format specifiers can leak memory contents, crash the daemon, or possibly perform arbitrary writes.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:iSulad affected range not listed fixed no fixed version listed

## How to check

- Check the installed iSulad version with `isula version` or the package manager, and compare it with the affected range through 2.1.6.
- Confirm whether the daemon runs container lifecycle operations through the isula runtime (shim) on the host.

## Timeline

- 2026-11-12T04:47:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111434

## From the sources

Use of Externally-Controlled format string vulnerability in openEuler iSulad on Linux.

This vulnerability is associated with program file src/daemon/modules/image/oci/oci_load.c.



This issue affects iSulad: through 2.1.6.



When the iSulad daemon performs container lifecycle operations (such as create, start, exec, stop, etc.) through the isula runtime (shim), the daemon reads the stderr output of the shim process via a pipe for error information display. If the buffer contains format specifiers such as %s, %x, or %n, it may trigger a format string vulnerability, potentially leading to information leakage, denial of service, or the risk of arbitrary writes.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_