Security Resilience

CVE-2026-86845

Published
14 October 2026
Modified
15 October 2026
CVSS Score v3.1 6.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
EPSS Score 0.0013 2th percentile
Risk Priority 44 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-86845 is a medium-severity Expired Pointer Dereference (CWE-825) vulnerability. Its CVSS base score is 6.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Security Account Manager (T1003.002); ranked at the 2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type before attaching it, leading to use-after-free or type confusion in the host vhost-crypto…

more

backend.

CWE(s)
CWE-825

Related Threats

MITRE ATT&CK Enterprise Techniques

T1003.002 Security Account Manager Credential Access
Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored.
attack.mitre.org →
T1003.003 NTDS Credential Access
Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights.
attack.mitre.org →
T1003.004 LSA Secrets Credential Access
Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.
attack.mitre.org →
T1003.007 Proc Filesystem Credential Access
Adversaries may gather credentials from the proc filesystem or `/proc`.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
T1007 System Service Discovery Discovery
Adversaries may try to gather information about registered local system services.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SA-11 Developer Testing and Evaluation partial match

Developer testing and evaluation (including fuzzing, static analysis, and dynamic memory checkers) directly finds expired-pointer dereferences before deployment.

SA-8 Security and Privacy Engineering Principles partial match

Secure engineering principles applied during design and implementation can mandate memory-safe allocation, ownership, and deallocation patterns that structurally avoid use of expired pointers.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

ID.AM-08 partial match
blocks

Lifecycle management includes secure development and maintenance phases that reduce memory-safety defects.

ID.RA-01 partial match
blocks

Vulnerability identification processes can discover use-after-free flaws via scanning or analysis.

PR.PS-02 partial match
blocks

Routine patching and replacement can eliminate known instances of expired-pointer bugs.

PR.PS-06 partial match
blocks

Secure-development practices directly prevent coding errors such as use-after-free while one CWE contributes only modestly to the full control.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.25 Secure development life cycle partial match
blocks

Secure development lifecycle practices can include pointer lifetime and memory-management rules that reduce expired-pointer dereferences.

A.8.26 Application security requirements partial match
blocks

A.8.26 only requires that security requirements (including resilience against attacks such as buffer overflows or SQL injection) be identified and specified during development or acquisition; it does not itself stop an expired pointer dereference from being introduced or from remaining exploitable in the resulting application.

A.8.27 Secure system architecture and engineering principles partial match
blocks

A.8.27 establishes and applies secure-by-design principles, architecture reviews, and hardening that can surface or avoid many classes of memory errors, but it does not stop an already-written expired-pointer dereference from being exploitable; that requires code changes (removal) or runtime mitigations (e.g. ASLR, bounds checking) supplied by other controls.

A.8.28 Secure coding partial match
prevents

Secure coding standards directly address pointer lifetime and deallocation discipline, substantially mitigating expired-pointer dereference.

A.8.29 Security testing in development and acceptance partial match
finds

Security testing can detect use-after-free issues, but removing this weakness alone does not fulfill the testing control.

A.8.32 Change management partial match
blocks

Change-management processes can require re-validation of memory safety after modifications, indirectly reducing the weakness.

References