Listen to this Post
CVE-2026-81625 is a critical stack-based buffer overflow vulnerability residing within the openvas-scanner component of Greenbone OS and related vulnerability management platforms.
The flaw specifically originates in the nasl_ntlmv1_hash function used during NASL script execution.
When processing authentication parameters within a vulnerability test script, the function copies the passhash argument into a fixed 21-byte stack buffer named p21.
The implementation performs an unsafe memory copy operation using standard C library functions like memcpy.
Although a minimum length of 16 bytes is enforced, the code completely lacks an upper-bound check on the incoming parameter length.
If a malicious or compromised NASL script supplies a passhash string longer than 21 bytes, the extra data spills past the boundary of the local stack buffer.
This unregulated memory overwrite corrupts adjacent stack frames, including saved frame pointers and return addresses.
An attacker with user privileges or control over a vulnerability test script can leverage this behavior to hijack the execution flow.
Successful execution allows the attacker to achieve arbitrary code execution on the underlying host system with the privileges of the scanner process.
Because vulnerability scanners typically operate with elevated privileges to perform deep network inspections, this compromise severely impacts the entire host security posture.
The vulnerability underscores the extreme risks associated with running unverified or untrusted scanning logic within centralized vulnerability assessment environments.
Remediation requires updating the affected scanner components to incorporate rigorous length validation and bounds checking on all input parameters.
DailyCVE Form:
Platform: OpenVAS Scanner
Version: Up to 23.49.3
Vulnerability : Buffer Overflow
Severity: High
date: August 27 2026
Prediction: September 10 2026
What Undercode Say:
git clone https://github.com/greenbone/openvas-scanner.git cd openvas-scanner git checkout v23.49.3 grep -rn "nasl_ntlmv1_hash" .
int nasl_ntlmv1_hash(lex_env env) {
char p21[bash];
// Unbounded memcpy vulnerability simulation
memcpy(p21, passhash, passhash_len);
}
Exploit: (Educational Purposes!)
An attacker deploys a crafted NASL script containing an oversized passhash parameter vector exceeding 21 bytes. When the openvas-scanner evaluates the malicious script, the nasl_ntlmv1_hash function executes the unbounded memcpy call, overwriting the stack memory. By carefully padding the input payload with shellcode and a manipulated return address, the attacker redirects execution control upon function return, executing arbitrary commands on the target host system.
Protection: from this CVE
Upgrade openvas-scanner to version 23.49.4 or later where proper upper-bound checks and length validations are enforced on input parameters. Restrict access to NASL script creation and ensure only trusted vulnerability tests are executed within the scanning environment. Deploy endpoint protection and monitor child process creation anomalies originating from scanner daemons.
Impact:
Compromise of the scanner host, unauthorized privilege escalation, execution of arbitrary commands with scanner privileges, potential lateral movement across monitored network segments, and complete integrity failure of the vulnerability management infrastructure.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
