Description

A remote attacker with user privileges may use a malicious or compromised NASL vulnerability test (VT) on the affected products to trigger a stack buffer overflow and gain full access on the compromised system.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-27T10:16:41.000Z",
  "pubdate": "2026-08-27T10:16:41.000Z",
  "executiveSummary": "A critical stack-based buffer overflow vulnerability exists within the processing logic of NASL vulnerability tests (VT). This security flaw allows a remote attacker possessing low-level user privileges to execute arbitrary code with elevated system permissions.\nThe vulnerability manifests when the application handles specially crafted NASL scripts, leading to memory corruption. Successful exploitation of this flaw grants an attacker full control over the compromised system, posing a severe risk to confidentiality, integrity, and availability.\nExploitation requires the attacker to submit a malicious or compromised NASL VT to the affected product. Since the attack occurs during the execution of these test scripts, it effectively bypasses standard security boundaries established for user-level accounts.\nThe risk implication is absolute system compromise, allowing for lateral movement, data exfiltration, or the installation of persistent malicious payloads. Remediation requires rigorous input validation of script processing functions and the implementation of robust memory protection mechanisms to prevent buffer overflows during test execution.",
  "technicalDetails": "The vulnerability is rooted in a stack-based buffer overflow condition occurring during the parsing and execution of NASL (Nessus Attack Scripting Language) vulnerability tests. The affected component fails to adequately validate the length of input data provided within an NASL script before copying it into a fixed-size stack buffer.\nIn a standard attack flow, a remote attacker with authenticated user access uploads or triggers a malicious NASL VT. Upon ingestion, the vulnerable parser allocates space on the execution stack to hold the script's instructions or data structures. Due to the lack of boundary checking—specifically a missing or ineffective 'memcpy' or 'strcpy' bounds verification—a specially crafted script can supply data that exceeds the allocated buffer capacity.\nBy exceeding the buffer boundary, the malicious payload overwrites adjacent memory, including the saved return address (or function pointers) on the stack frame. By precisely controlling the overflow content, the attacker can redirect the instruction pointer (EIP/RIP) to execute arbitrary shellcode injected within the malicious NASL script or point to existing code (e.g., Return-Oriented Programming chains) to bypass Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR).\nBecause the NASL execution engine often operates with higher privileges than the authenticated user submitting the test, the execution of this overflow results in a full privilege escalation. The attack does not require direct memory access to the host OS kernel initially, but it leverages the high-privilege context of the scanner service itself to gain 'full access' on the underlying system. Once control flow is hijacked, the attacker can execute system-level commands, modify local configurations, install backdoors, or disable security monitoring features.\nThis vulnerability is particularly dangerous because NASL scripts are inherently trusted by the product to perform diagnostic functions. The failure to sanitize these scripts effectively converts a routine vulnerability scanning operation into a vector for remote code execution (RCE). Post-exploitation impact includes complete system compromise, as the attacker achieves execution within the context of the service account, which is typically a high-privileged user in the architecture of such scanners."
}