Skip to main content

Get a free FHIR vulnerability scan, funded by Cantina.
All disclosures

Vulnerability disclosure

NVMe deallocate loop can write a 257th descriptor

CVE-2026-10718

Affected product
Seagate openSeaChest
Severity
Medium · CVSS 4.6
Weakness
CWE-787
Disclosed

Summary

An inclusive descriptor limit allowed the NVMe Trim/Deallocate path to attempt a 16-byte write beyond its 4,096-byte stack buffer.

Technical analysis

The accompanying research article explains the finding, reproduction, and remediation status.

Read the technical write-up

Disclosure timeline

Public disclosure

Credits

Cantina · Agent-discovered and human-verified

References