PT-2026-4858 · Gmrtd · Gmrtd

Ramrunner

·

Publicado

2026-01-27

·

Atualizado

2026-03-04

·

CVE-2026-24738

CVSS v3.1

6.5

Média

VetorAV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions gmrtd versions prior to 0.17.2
Description The gmrtd Go library contains a flaw where the ReadFile function accepts TLVs (Tag-Length-Value) with lengths up to 4GB. This can lead to excessive resource consumption, including memory and CPU cycles, potentially causing slowdowns or making the receiving thread unresponsive. A malicious NFC (Near Field Communication) chip can exploit this by sending dummy bytes in chunks, overwhelming the system. This issue affects projects using the gmrtd library to read files from NFCs. The vulnerability arises from the unconstrained resource consumption during the processing of large TLVs, specifically when reading data in 256-byte chunks.
Recommendations Update to gmrtd version 0.17.2 or later.

Exploit

Correção

DoS

Resource Exhaustion

Allocation of Resources Without Limits

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-400CWE-770

Identificadores relacionados

CVE-2026-24738
GHSA-J49H-6577-5XWQ
GO-2026-4379
SUSE-SU-2026:0403-1

Produtos afetados

Gmrtd