Partial String Comparison in AIDE - #VU158246
Published: October 28, 2026
Vulnerability identifier: #VU158246
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-187
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass AIDE detection of malicious file changes.
The vulnerability exists due to improper partial comparison of hash values in the bytecmp function when checking file integrity. A remote attacker can craft a modified file whose hash matches the stored hash in every byte up to and including the first null byte to cause the hash change to be silently ignored. The function uses strncmp instead of memcmp, so bytes after the null byte are not compared.
Affected software
AIDE
Remediation
Install security update from vendor's website.
AIDE - update to 0.19.5