CVE-2026-10717 Overview
CVE-2026-10717 is an out-of-bounds write and read vulnerability in the --showSCSIDefects feature of Seagate's openSeaChest v25.05.3. The flaw affects all supported platforms when the utility parses defect information returned by a SCSI device. A drive with an excessively large defect list, or a maliciously crafted SCSI device returning an oversized defect response length, can trigger the out-of-bounds memory access. The weakness is classified as [CWE-787] Out-of-Bounds Write. Exploitation requires local access, high privileges, and specialized conditions, limiting practical impact.
Critical Impact
A malicious or malfunctioning SCSI device can cause openSeaChest to write defect data outside allocated buffers, leading to memory corruption on the host running the utility.
Affected Products
- Seagate openSeaChest v25.05.3
- All supported platforms running the affected openSeaChest build
- Hosts using the --showSCSIDefects operation against attached SCSI devices
Discovery Timeline
- 2026-06-02 - CVE-2026-10717 published to NVD
- 2026-06-02 - Last updated in NVD database
Technical Details for CVE-2026-10717
Vulnerability Analysis
The vulnerability resides in the --showSCSIDefects command path of openSeaChest, a Seagate-maintained open-source drive utility. When the tool issues a SCSI READ DEFECT DATA command, it parses the returned defect list using a length field supplied by the device. The parser does not adequately bound that length against the allocated buffer. A drive reporting an unusually large defect list, or a device that fabricates an oversized defect response length, drives the parsing loop beyond the buffer boundary. The result is out-of-bounds reads and writes in process memory of the user running the utility.
Because the utility typically runs with elevated privileges to issue raw SCSI commands, memory corruption occurs in a privileged context. However, the attack vector is local and requires the attacker to control or substitute the storage device. The EPSS data indicates a very low likelihood of in-the-wild exploitation.
Root Cause
The root cause is insufficient validation of an attacker-controlled length field originating from a SCSI defect response. The parsing routine trusts the device-supplied size when iterating defect entries, allowing writes past the end of the destination buffer for very large defect lists.
Attack Vector
Exploitation requires local execution of openSeaChest --showSCSIDefects against a controlled or compromised SCSI device. An attacker must present a malicious device, or supply a drive with a corrupted firmware response, while the operator runs the diagnostic with the privileges needed for raw SCSI access. Network exploitation is not possible. See the Seagate Security Advisories for technical details.
Detection Methods for CVE-2026-10717
Indicators of Compromise
- Unexpected crashes or segmentation faults from openSeaChest processes invoked with --showSCSIDefects.
- Diagnostic runs against unknown or untrusted SCSI devices, USB-to-SCSI bridges, or removable media of unverified origin.
- Anomalous SCSI READ DEFECT DATA responses reporting defect list lengths larger than physical media plausibility.
Detection Strategies
- Audit command-line execution history for openSeaChest invocations using --showSCSIDefects on workstations and storage administration hosts.
- Monitor for process termination signals or core dumps tied to openSeaChest binaries.
- Inventory installed versions of openSeaChest and flag instances at or below v25.05.3.
Monitoring Recommendations
- Log privileged tool execution in storage maintenance workflows and review for unexpected device targets.
- Restrict who can attach external storage devices to systems where openSeaChest is installed.
- Alert on installation of unsigned or outdated openSeaChest binaries via software inventory tooling.
How to Mitigate CVE-2026-10717
Immediate Actions Required
- Identify all hosts with openSeaChest v25.05.3 or earlier and remove or upgrade the utility.
- Avoid running --showSCSIDefects against untrusted, unknown, or potentially failing drives until a fixed build is deployed.
- Limit execution of openSeaChest to a defined set of administrators with curated, trusted hardware.
Patch Information
Consult the Seagate Security Advisories page for the fixed release of openSeaChest. Download updated binaries from Seagate SeaChest Software Support and replace v25.05.3 installations on every supported platform.
Workarounds
- Refrain from using the --showSCSIDefects operation on devices of unknown provenance.
- Quarantine suspect drives and analyze them on isolated systems lacking sensitive data.
- Enforce hardware allowlists or USB/SCSI port controls on systems that run drive diagnostic utilities.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
