PT-2026-37174 · Grid · Grid

Ksj1230 · Published 2026-04-24 · Updated 2026-05-09 · CVE-2026-42199

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Grid versions 0.17.0 through 1.0.0

Description An integer overflow in the expand rows() function can corrupt the relationship between the grid's logical dimensions and its backing storage. This occurs because the function computes the new backing length using unchecked arithmetic. If the calculation overflows, the backing storage may be resized to a length smaller than required. Consequently, the safe API get() may invoke get unchecked() with an invalid index, leading to Undefined Behavior, which is a state where the program's behavior is no longer predictable and may result in crashes or denial of service.

Recommendations Update to version 1.0.1.

Exploit

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2026-42199

GHSA-38C5-483C-4QQP

Affected Products

Grid

References · 7

• 🔥 https://github.com/becheran/grid/security/advisories/GHSA-38c5-483c-4qqp · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-42199 · Security Note
• https://osv.dev/vulnerability/GHSA-38c5-483c-4qqp · Vendor Advisory
• https://github.com/becheran/grid/commit/be213bd3528727148bef2d523c89e95d1fd9c072 · Note
• https://github.com/becheran/grid · Note
• https://github.com/becheran/grid/releases/tag/v1.0.1 · Note
• https://twitter.com/CVEnew/status/2053131440439841155 · Twitter Post