SB2026081333 - Multiple vulnerabilities in Dell Encryption

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026081333

SB2026081333 - Multiple vulnerabilities in Dell Encryption

Published: August 13, 2026

Security Bulletin ID SB2026081333
CSH Severity
High
Patch available
YES
Number of vulnerabilities 7
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 14% Medium 71% Low 14%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 7 vulnerabilities.


1) Integer overflow (CVE-ID: CVE-2026-25210)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow within the doContent() function. A remote attacker can pass specially crafted XML data to the application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


2) Resource exhaustion (CVE-ID: CVE-2025-59375)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can trigger large dynamic memory allocations via a small document and perform a denial of service (DoS) attack.


3) Infinite loop (CVE-ID: CVE-2026-32777)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an infinite loop in the DTD content parser when processing a specially crafted XML file. A remote attacker can send a specially crafted request to cause a denial of service.


4) NULL pointer dereference (CVE-ID: CVE-2026-32778)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the function setContext in libexpat when processing XML input under low-memory conditions. A remote attacker can send a specially crafted XML file to cause a denial of service.

Exploitation requires repeated processing of malicious input following an initial out-of-memory condition.


5) Resource exhaustion (CVE-ID: CVE-2025-66382)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when processing large files. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.


6) NULL Pointer Dereference (CVE-ID: CVE-2026-32776)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the XML parser when processing malicious XML content with empty external parameter entity content. A remote attacker can send a specially crafted XML file to cause a denial of service.


7) NULL pointer dereference (CVE-ID: CVE-2026-24515)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in XML_ExternalEntityParserCreate. A remote attacker can pass specially crafted XML data to the application and perform a denial of service (DoS) attack.


Remediation

Install update from vendor's website.

References