{"id":"CVE-2026-91760","kind":"vulnerability","aliases":["CVE-2026-91760"],"related":[],"title":"Hitachi Dynamic Link Manager for Linux: heap overflow may let attackers run code","description":"Heap-based Buffer Overflow Vulnerability in Hitachi Dynamic Link Manager for Linux.\n\n\nThis issue affects Hitachi Dynamic Link Manager for Linux: from 7.5.0-00 before 9.0.5-00.","summary":"Hitachi Dynamic Link Manager for Linux has a heap-based buffer overflow in versions from 7.5.0-00 before 9.0.5-00. The sources do not say what input triggers it or what an attacker can fully achieve, beyond the memory corruption.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Hitachi Dynamic Link Manager for Linux","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["dynamic-link-manager","hitachi","infrastructure","linux","multipath"],"not_affected_if":["version-outside-range"],"how_to_check":"- Check the installed Dynamic Link Manager for Linux version against the affected range `7.5.0-00` to `9.0.5-00` (exclusive)","fix":"- Move Hitachi Dynamic Link Manager for Linux to `9.0.5-00` or later","status":"open","published_at":"2026-11-10T05:18:15+00:00","first_seen_at":"2026-11-10T05:19:58+00:00","triaged_at":"2026-11-10T05:22:25+00:00","updated_at":"2026-11-10T05:22:25+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T05:22:25Z","model":"claude-haiku-5-5","output":{"fix":"- Move Hitachi Dynamic Link Manager for Linux to `9.0.5-00` or later","reach":"unknown","title":"Hitachi Dynamic Link Manager for Linux: heap overflow may let attackers run code","impact":"high","summary":"Hitachi Dynamic Link Manager for Linux has a heap-based buffer overflow in versions from 7.5.0-00 before 9.0.5-00. The sources do not say what input triggers it or what an attacker can fully achieve, beyond the memory corruption.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["hitachi","dynamic-link-manager","linux","multipath"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown; heap corruption may allow code execution","analyst_note":"Confirm the trigger, required privilege and reach from the Hitachi advisory and https://nvd.nist.gov/vuln/detail/CVE-2026-91760.","how_to_check":"- Check the installed Dynamic Link Manager for Linux version against the affected range `7.5.0-00` to `9.0.5-00` (exclusive)\n- unknown for any other check, as the sources do not say","plain_action":"","product_name":"Hitachi Dynamic Link Manager for Linux","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"Teams running Hitachi Dynamic Link Manager for Linux in the affected range, typically on servers that manage multipath storage paths. The sources do not describe the input or the privilege needed to reach the overflow, so exposure beyond the installed version is unknown. Systems on other versions, or without this product installed, are not affected.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000784,"input_tokens":4540,"output_tokens":659,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-00':51B,54B,99C,102C '-2026':15A,18A '-91760':16A,19A '7.5.0':50B,98C '9.0.5':53B,101C 'achiev':70B 'affect':90C 'attack':11A,67B 'base':44B,77C 'beyond':71B 'buffer':45B,78C 'code':13A 'corrupt':74B 'cve':14A,17A 'dynam':2A,27B,35B,83C,92C 'dynamic':21A 'dynamic-link-manag':26B 'for':24A 'fulli':69B 'heap':7A,43B,76C 'heap-bas':42B,75C 'hitachi':1A,20A,30B,34B,82C,91C 'infrastructur':31B 'input':61B 'issu':89C 'let':10A 'link':3A,22A,28B,36B,84C,93C 'linux':6A,25A,32B,39B,87C,96C 'manag':4A,29B,37B,85C,94C 'manager':23A 'may':9A 'memori':73B 'multipath':33B 'overflow':8A,46B,79C 'run':12A 'say':59B 'sourc':56B 'trigger':62B 'version':48B 'vulner':80C","nicknames":[],"mitigations":[],"who_affected":"Teams running Hitachi Dynamic Link Manager for Linux in the affected range, typically on servers that manage multipath storage paths. The sources do not describe the input or the privilege needed to reach the overflow, so exposure beyond the installed version is unknown. Systems on other versions, or without this product installed, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["dynamiclinkmanagerforlinux","hitachidynamiclinkmanagerforlinux"],"ptokens":["dynamic","for","hitachi","link","linux","manager"],"labels":["dynamiclinkmanager","high","hitachi","infrastructure","linux","multipath","vendor"],"campaign_type":null,"search_a":"'-2026':15A,18A '-91760':16A,19A 'attack':11A 'code':13A 'cve':14A,17A 'dynam':2A 'dynamic':21A 'for':24A 'heap':7A 'hitachi':1A,20A 'let':10A 'link':3A,22A 'linux':6A,25A 'manag':4A 'manager':23A 'may':9A 'overflow':8A 'run':12A","search_b":"'-00':51B,54B '7.5.0':50B '9.0.5':53B 'achiev':70B 'attack':67B 'base':44B 'beyond':71B 'buffer':45B 'corrupt':74B 'dynam':27B,35B 'dynamic-link-manag':26B 'fulli':69B 'heap':43B 'heap-bas':42B 'hitachi':30B,34B 'infrastructur':31B 'input':61B 'link':28B,36B 'linux':32B,39B 'manag':29B,37B 'memori':73B 'multipath':33B 'overflow':46B 'say':59B 'sourc':56B 'trigger':62B 'version':48B","search_c":"'-00':99C,102C '7.5.0':98C '9.0.5':101C 'affect':90C 'base':77C 'buffer':78C 'dynam':83C,92C 'heap':76C 'heap-bas':75C 'hitachi':82C,91C 'issu':89C 'link':84C,93C 'linux':87C,96C 'manag':85C,94C 'overflow':79C 'vulner':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T05:18:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"hirt@hitachi.co.jp","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91760","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91760","severity":null,"published_at":"2026-11-10T05:18:15+00:00","modified_at":"2026-11-10T05:18:15+00:00","first_seen_at":"2026-11-10T05:19:58+00:00","fetched_at":"2026-11-10T05:19:58+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}