Cyber Resilience

CVE-2026-44310

Published
15 May 2026
Modified
17 June 2026
CVSS Score v3.1 5.4
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
EPSS Score 0.0011 2th percentile
Risk Priority 40 floored blend · peak EPSS

Summary

CVE-2026-44310 is a medium-severity Improper Validation of Array Index (CWE-129) vulnerability. Its CVSS base score is 5.4 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. From 0.4.0 to before 0.15.0, CertVerifier.Verify() in pkg/git/verifier.go unconditionally dereferences certs[0] after sd.GetCertificates() without checking the slice length. A CMS/PKCS7 signed message…

more

with an empty certificate set is a structurally valid DER payload; GetCertificates() returns an empty slice with no error, causing an immediate index-out-of-range panic. On the gitsign --verify code path (the GPG-compatible mode invoked by git verify-commit), the panic is silently recovered by internal/io/streams.go's Wrap() function, which returns nil instead of an error. main.go then exits with code 0, causing exit-code-only verification callers to interpret the failed verification as success. This vulnerability is fixed in 0.15.0.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
T1211 Exploitation for Stealth Stealth
Adversaries may exploit vulnerabilities to evade detection by hiding activity, suppressing logging, or operating within trusted or unmonitored components.
T1212 Exploitation for Credential Access Credential Access
Adversaries may exploit software vulnerabilities in an attempt to collect credentials.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-52594Shared CWE-129
CVE-2024-38562Shared CWE-129
CVE-2024-36015Shared CWE-129
CVE-2025-10158Shared CWE-129
CVE-2023-52728Shared CWE-129
CVE-2026-32682Shared CWE-129
CVE-2025-54650Shared CWE-129
CVE-2026-57264Shared CWE-129
CVE-2025-39728Shared CWE-129
CVE-2024-49930Shared CWE-129

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

Developer testing and evaluation will surface code paths that detect errors yet perform no subsequent action.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

DE.AE-08 mostly match
prevents

Declaring incidents when criteria are met forces action on detected errors; eliminating the weakness helps but does not define the criteria themselves.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require input validation and bounds checking that prevent improper array indexing.

RS.MA-02 mostly match
prevents

Triaging and validating reports compels follow-up on detections; removing the weakness supports but does not replace triage processes.

DE.AE-02 partial match
prevents

Analysis of detected events directly counters ignoring them, but does not guarantee every error condition is covered.

DE.CM-09 partial match
prevents

Monitoring produces detections, yet supplies no requirement to act on them.

PR.PS-04 partial match
prevents

Generating logs enables later action but does not enforce handling of each error condition.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing in development can detect out-of-bounds array access but does not prevent the weakness by itself.

A.8.15 Logging partial match
finds

Logging captures error conditions but does not guarantee subsequent handling or remediation.

finds

Monitoring activities can detect errors, yet without defined response procedures the weakness persists.

prevents

Secure development lifecycle mandates input validation and bounds checking that directly prevents improper array indexing.

prevents

Application security requirements include validation of untrusted input used for indexing or addressing memory structures.

prevents

Secure architecture principles encourage defensive coding patterns that reduce index-related vulnerabilities.

References