Description

Tanium addressed a compression bomb vulnerability in Findings.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-08-19T21:16:53.373Z",
  "pubdate": "2026-08-19T21:16:53.373Z",
  "executiveSummary": "A compression bomb vulnerability has been identified and addressed in the Tanium Findings product. This security flaw involves improper handling of compressed data streams, which can be leveraged by malicious actors to exhaust critical system resources, specifically CPU and memory, leading to a denial of service (DoS) state. The vulnerability resides within the data processing routines of Tanium Findings, where unconstrained decompression of untrusted input allows high compression ratio payloads to expand exponentially upon ingestion. Successful exploitation of this vulnerability severely impacts the availability of the affected systems, potentially disrupting endpoint visibility and security operations management. Attackers typically require the capability to supply or influence compressed payloads processed by the application. While explicit authentication and network exposure parameters are dependent on the specific deployment architecture, the risk implications center around service degradation, resource exhaustion, and operational downtime. Remediation requires applying the vendor-supplied updates or patches provided by Tanium to enforce strict resource limits and safe decompression limits on incoming data streams.",
  "technicalDetails": "The vulnerability is rooted in the absence of stringent size validation and resource bounding during the decompression phase of data archives or streams handled by Tanium Findings. When a software component processes compressed input without enforcing limits on the maximum allowable uncompressed size or memory allocation thresholds, it becomes susceptible to zip bomb or compression bomb attacks.\nThe exploitation method relies on supplying a specially crafted, highly compressed payload—often only a few kilobytes in size—that expands exponentially into gigabytes of raw data when parsed by the vulnerable decompression routine. The attack flow begins when an authenticated or unauthenticated threat actor (depending on the specific ingestion vector of Tanium Findings) submits the malicious payload into the data processing pipeline.\nUpon ingestion, the vulnerable component attempts to expand the archive. As the decompression algorithm processes the recursive or highly redundant data structures, memory consumption spikes rapidly, and CPU cycles are monopolized by the decompression routine. This behavior starves other critical system processes of essential resources, culminating in application crashes, unresponsiveness, or complete system instability.\nThe vulnerable component is explicitly tied to the data parsing and archive extraction modules within Tanium Findings. Exploitation may occur locally or remotely based on how data is fed into the findings engine. Post-exploitation impact is primarily characterized by a denial of service, preventing administrators from querying endpoint data, assessing vulnerabilities, or maintaining compliance postures until services are forcibly restarted and the offending payload is removed."
}