{"id":"CVE-2026-54437","kind":"vulnerability","aliases":["CVE-2026-54437"],"related":[],"title":"io-char library: input validation flaw lets local user tamper with device buffer","description":"Improper Input Validation in the io-char library's\nDCMD_CHR_TCINJECTC devctl() handler could allow an attacker with local access\nto cause data tampering in the memory input buffer of the Character I/O device\ndriver.","summary":"The io-char library's DCMD_CHR_TCINJECTC devctl() handler does not validate input properly in the Character I/O device driver. A local attacker can tamper with data in the memory input buffer.","severity":"medium","cvss":6.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"io-char","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["io-char","other"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:21:16+00:00","first_seen_at":"2026-11-10T19:25:15+00:00","triaged_at":"2026-11-10T19:58:28+00:00","updated_at":"2026-11-10T19:58:28+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-10T19:58:28Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"io-char library: input validation flaw lets local user tamper with device buffer","impact":"low","summary":"The io-char library's DCMD_CHR_TCINJECTC devctl() handler does not validate input properly in the Character I/O device driver. A local attacker can tamper with data in the memory input buffer.","audience":"businesses","category":"other","nicknames":[],"who_cares":["io-char"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"local user tampers with device input buffer data","analyst_note":"Find the affected products, versions and fixed release from the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-54437 or the vendor advisory.","how_to_check":"unknown","plain_action":"","product_name":"io-char","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Affects systems running the io-char library's Character I/O device driver, where a local user can call the DCMD_CHR_TCINJECTC devctl() handler. The sources do not say which products or versions ship it, or whether non-local access is possible. unknown","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000681,"input_tokens":4538,"output_tokens":455,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-54437':17A,20A 'access':82C 'allow':77C 'attack':51B,79C 'buffer':14A,60B,91C 'caus':84C 'char':3A,23A,26B,30B,68C 'charact':45B,94C 'chr':34B,72C 'could':76C 'cve':15A,18A 'data':55B,85C 'dcmd':33B,71C 'devctl':36B,74C 'devic':13A,47B,96C 'driver':48B,97C 'flaw':7A 'handler':37B,75C 'i/o':46B,95C 'improp':61C 'input':5A,41B,59B,62C,90C 'io':2A,22A,25B,29B,67C 'io-char':1A,21A,24B,28B,66C 'let':8A 'librari':4A,31B,69C 'local':9A,50B,81C 'memori':58B,89C 'proper':42B 'tamper':11A,53B,86C 'tcinjectc':35B,73C 'user':10A 'valid':6A,40B,63C","nicknames":[],"mitigations":[],"who_affected":"Affects systems running the io-char library's Character I/O device driver, where a local user can call the DCMD_CHR_TCINJECTC devctl() handler. The sources do not say which products or versions ship it, or whether non-local access is possible. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["iochar"],"ptokens":["char","io"],"labels":["iochar","medium","other","vendor"],"campaign_type":null,"search_a":"'-2026':16A,19A '-54437':17A,20A 'buffer':14A 'char':3A,23A 'cve':15A,18A 'devic':13A 'flaw':7A 'input':5A 'io':2A,22A 'io-char':1A,21A 'let':8A 'librari':4A 'local':9A 'tamper':11A 'user':10A 'valid':6A","search_b":"'attack':51B 'buffer':60B 'char':26B,30B 'charact':45B 'chr':34B 'data':55B 'dcmd':33B 'devctl':36B 'devic':47B 'driver':48B 'handler':37B 'i/o':46B 'input':41B,59B 'io':25B,29B 'io-char':24B,28B 'librari':31B 'local':50B 'memori':58B 'proper':42B 'tamper':53B 'tcinjectc':35B 'valid':40B","search_c":"'access':82C 'allow':77C 'attack':79C 'buffer':91C 'caus':84C 'char':68C 'charact':94C 'chr':72C 'could':76C 'data':85C 'dcmd':71C 'devctl':74C 'devic':96C 'driver':97C 'handler':75C 'i/o':95C 'improp':61C 'input':62C,90C 'io':67C 'io-char':66C 'librari':69C 'local':81C 'memori':89C 'tamper':86C 'tcinjectc':73C 'valid':63C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cvss_by":"secure@blackberry.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-54437","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54437","severity":null,"published_at":"2026-11-10T19:21:16+00:00","modified_at":"2026-11-10T19:21:16+00:00","first_seen_at":"2026-11-10T19:25:15+00:00","fetched_at":"2026-11-10T19:25:15+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}