PT-2026-50769 · Pam Usb · Pam Usb

Mcdope · CVE-2026-48984 · Published 2026-06-18 · Updated 2026-06-22

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions pam usb versions 0.9.1 and earlier

Description The xfree() memory release helper calls free() without zeroing buffer contents first. This results in heap-allocated buffers containing sensitive data, such as one-time pad bytes read from disk, being released without being cleared. Consequently, sensitive content remains in freed heap memory until overwritten by a subsequent allocation. In scenarios where a heap inspection primitive is available or a use-after-free condition exists, this could allow the recovery of authentication material or pad values from freed memory regions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-226

CWE-14

Related Identifiers

CVE-2026-48984

GHSA-RMP6-WFRQ-WRRC

Affected Products

Pam Usb

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48984.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-48984 · Security Note
• https://osv.dev/vulnerability/CVE-2026-48984 · Vendor Advisory
• https://github.com/mcdope/pam_usb/releases/tag/0.9.2 · Note
• https://github.com/mcdope/pam_usb/security/advisories/GHSA-rmp6-wfrq-wrrc · Note
• https://t.me/cveNotify/171800 · Telegram Post
• https://t.me/CVEtracker/57279 · Telegram Post
• https://t.me/cveNotify/170725 · Telegram Post
• https://t.me/cveNotify/170646 · Telegram Post