CVE-2026-10719 Overview
CVE-2026-10719 is an out-of-bounds write vulnerability in the --showSupportedFormats feature of Seagate's openSeaChest v25.05.3. The flaw allows a one-byte write outside an allocated buffer when the tool parses a maliciously crafted Non-Volatile Memory Express (NVMe) device that reports a bogus value in the namespace FLBAS byte. Exploitation requires local access, high privileges, and the presence of an attacker-controlled NVMe device, which constrains practical impact. The issue affects openSeaChest on all supported platforms.
Critical Impact
A crafted NVMe device can trigger a single-byte out-of-bounds write that sets an adjacent memory location to the value 1, producing limited integrity and availability impact on the host running openSeaChest.
Affected Products
- Seagate openSeaChest v25.05.3 on all supported platforms
- The --showSupportedFormats command path that parses NVMe namespace metadata
- Hosts that enumerate untrusted NVMe devices using openSeaChest
Discovery Timeline
- 2026-06-02 - CVE-2026-10719 published to the National Vulnerability Database (NVD)
- 2026-06-02 - Last updated in NVD database
Technical Details for CVE-2026-10719
Vulnerability Analysis
The vulnerability is an out-of-bounds write classified under [CWE-787]. When openSeaChest executes the --showSupportedFormats option against an NVMe device, it reads the namespace FLBAS (Formatted LBA Size) field and uses the value to index or size operations on a buffer that tracks supported LBA formats. A malformed FLBAS value pushes the write past the end of the allocated buffer by one byte. The off-by-one writes a constant value of 1 into adjacent memory rather than attacker-controlled data, which limits the scope of corruption. Exploitation requires the attacker to attach a malicious or emulated NVMe device to the system and to invoke openSeaChest with elevated privileges, since NVMe administrative commands typically require root or administrator rights.
Root Cause
The root cause is missing bounds validation on the namespace FLBAS byte returned from the device before it is used to compute a write offset inside openSeaChest. The code path trusts firmware-supplied metadata and does not constrain the index to the actual number of supported LBA formats. This is a classic input validation failure where untrusted hardware-supplied data is treated as authoritative.
Attack Vector
The attack vector is local with high attack complexity and high privileges. An attacker presents a crafted NVMe device, such as a physical drive with modified firmware or an emulated NVMe target, to a host that runs openSeaChest --showSupportedFormats. When the tool queries the namespace identifier, the device returns a FLBAS value chosen to overflow the buffer boundary by one byte. No user interaction beyond launching the tool against the device is required. Verified code examples are not available; refer to the Seagate Security Advisories for technical details once published.
Detection Methods for CVE-2026-10719
Indicators of Compromise
- Unexpected crashes or memory corruption warnings from openSeaChest processes when scanning newly attached NVMe devices
- Connection of unauthorized or unrecognized NVMe storage devices to managed hosts and servers
- NVMe identify-namespace responses where the FLBAS byte exceeds the number of supported LBA formats reported by the controller
Detection Strategies
- Inventory hosts that ship openSeaChest v25.05.3 and flag invocations of --showSupportedFormats against removable or hot-plugged NVMe targets
- Compare NVMe identify data captured at attach time against expected vendor profiles to surface devices returning anomalous FLBAS values
- Alert on process crashes, segmentation faults, or heap corruption reports tied to the openSeaChest binary in system logs and crash dumps
Monitoring Recommendations
- Forward kernel and userspace crash telemetry from administrative workstations and storage servers to a centralized log platform for review
- Monitor for udev, PCIe hot-plug, and NVMe attach events that precede execution of openSeaChest commands
- Track the version of openSeaChest deployed across the fleet and alert when v25.05.3 remains present after a fixed release is available
How to Mitigate CVE-2026-10719
Immediate Actions Required
- Restrict execution of openSeaChest --showSupportedFormats to trusted operators and trusted NVMe devices only
- Prevent attachment of untrusted NVMe devices to systems used for storage administration, including in lab and bench environments
- Audit administrative tooling inventories to identify all hosts running openSeaChest v25.05.3
Patch Information
Consult the Seagate Security Advisories page and the Seagate SeaChest Software Support page for the fixed release of openSeaChest. Upgrade all instances of v25.05.3 to the patched version once Seagate publishes it.
Workarounds
- Avoid running openSeaChest --showSupportedFormats against NVMe devices of unknown provenance until the fixed release is deployed
- Use alternative read-only inspection tools such as nvme id-ns for namespace enumeration on untrusted hardware
- Enforce physical access controls and USB or PCIe port policies to block introduction of rogue NVMe devices
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
