{"id":"CVE-2026-91754","kind":"vulnerability","aliases":["CVE-2026-91754"],"related":[],"title":"Hitachi Dynamic Link Manager for VMware: stack buffer overflow may let attackers run code","description":"Stack-based Buffer Overflow Vulnerability in Hitachi Dynamic Link Manager for VMware.\n\nThis issue affects Hitachi Dynamic Link Manager for VMware: from 8.7.3-00 before 9.0.4-01.","summary":"Hitachi Dynamic Link Manager for VMware has a stack-based buffer overflow in versions from 8.7.3-00 before 9.0.4-01. A successful attack can corrupt memory on the affected system, and the sources do not say what an attacker can run from there.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Hitachi Dynamic Link Manager for VMware","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["dynamic-link-manager","hitachi","infrastructure","vmware","windows"],"not_affected_if":[],"how_to_check":"- Check the installed Dynamic Link Manager for VMware version against `8.7.3-00` through `9.0.4-01` (exclusive) on hosts that run it.","fix":"- Hitachi Dynamic Link Manager for VMware: move to `9.0.4-01` or later.","status":"open","published_at":"2026-11-10T05:18:12+00:00","first_seen_at":"2026-11-10T05:19:58+00:00","triaged_at":"2026-11-10T05:22:13+00:00","updated_at":"2026-11-10T05:22:13+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T05:22:13Z","model":"claude-haiku-5-5","output":{"fix":"- Hitachi Dynamic Link Manager for VMware: move to `9.0.4-01` or later.","reach":"unknown","title":"Hitachi Dynamic Link Manager for VMware: stack buffer overflow may let attackers run code","impact":"high","summary":"Hitachi Dynamic Link Manager for VMware has a stack-based buffer overflow in versions from 8.7.3-00 before 9.0.4-01. A successful attack can corrupt memory on the affected system, and the sources do not say what an attacker can run from there.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["hitachi","dynamic-link-manager","vmware","windows"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"unknown; memory corruption on the affected host, code execution not stated","analyst_note":"Confirm attack preconditions, reach and worst case from the Hitachi advisory and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-91754.","how_to_check":"- Check the installed Dynamic Link Manager for VMware version against `8.7.3-00` through `9.0.4-01` (exclusive) on hosts that run it.\n- unknown for any other check; the sources do not say.","plain_action":"","product_name":"Hitachi Dynamic Link Manager for VMware","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations that run Hitachi Dynamic Link Manager for VMware versions from 8.7.3-00 before 9.0.4-01 are affected. The sources do not say which configurations or network exposure are needed to trigger the overflow, so unknown for whether a team can skip it.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000784,"input_tokens":4540,"output_tokens":659,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-00':52B,101C '-01':55B,104C '-2026':16A,19A '-91754':17A,20A '8.7.3':51B,100C '9.0.4':54B,103C 'affect':64B,92C 'attack':12A,58B,74B 'base':45B,79C 'buffer':8A,46B,80C 'code':14A 'corrupt':60B 'cve':15A,18A 'dynam':2A,28B,36B,85C,94C 'dynamic':22A 'dynamic-link-manag':27B 'for':25A 'hitachi':1A,21A,31B,35B,84C,93C 'infrastructur':32B 'issu':91C 'let':11A 'link':3A,23A,29B,37B,86C,95C 'manag':4A,30B,38B,87C,96C 'manager':24A 'may':10A 'memori':61B 'overflow':9A,47B,81C 'run':13A,76B 'say':71B 'sourc':68B 'stack':7A,44B,78C 'stack-bas':43B,77C 'success':57B 'system':65B 'version':49B 'vmware':6A,26A,33B,40B,89C,98C 'vulner':82C 'window':34B","nicknames":[],"mitigations":[],"who_affected":"Organizations that run Hitachi Dynamic Link Manager for VMware versions from 8.7.3-00 before 9.0.4-01 are affected. The sources do not say which configurations or network exposure are needed to trigger the overflow, so unknown for whether a team can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["dynamiclinkmanagerforvmware","hitachidynamiclinkmanagerforvmware"],"ptokens":["dynamic","for","hitachi","link","manager","vmware"],"labels":["dynamiclinkmanager","high","hitachi","infrastructure","vendor","vmware","windows"],"campaign_type":null,"search_a":"'-2026':16A,19A '-91754':17A,20A 'attack':12A 'buffer':8A 'code':14A 'cve':15A,18A 'dynam':2A 'dynamic':22A 'for':25A 'hitachi':1A,21A 'let':11A 'link':3A,23A 'manag':4A 'manager':24A 'may':10A 'overflow':9A 'run':13A 'stack':7A 'vmware':6A,26A","search_b":"'-00':52B '-01':55B '8.7.3':51B '9.0.4':54B 'affect':64B 'attack':58B,74B 'base':45B 'buffer':46B 'corrupt':60B 'dynam':28B,36B 'dynamic-link-manag':27B 'hitachi':31B,35B 'infrastructur':32B 'link':29B,37B 'manag':30B,38B 'memori':61B 'overflow':47B 'run':76B 'say':71B 'sourc':68B 'stack':44B 'stack-bas':43B 'success':57B 'system':65B 'version':49B 'vmware':33B,40B 'window':34B","search_c":"'-00':101C '-01':104C '8.7.3':100C '9.0.4':103C 'affect':92C 'base':79C 'buffer':80C 'dynam':85C,94C 'hitachi':84C,93C 'issu':91C 'link':86C,95C 'manag':87C,96C 'overflow':81C 'stack':78C 'stack-bas':77C 'vmware':89C,98C 'vulner':82C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T05:18:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"hirt@hitachi.co.jp","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91754","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91754","severity":null,"published_at":"2026-11-10T05:18:12+00:00","modified_at":"2026-11-10T05:18:12+00:00","first_seen_at":"2026-11-10T05:19:58+00:00","fetched_at":"2026-11-10T05:19:58+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}