CVE-2026-79900: boks_ksllogsd Buffer Overflow Vulnerability

CVE-2026-79900 Overview

CVE-2026-79900 is a heap out-of-bounds write vulnerability in the boks_ksllogsd component. The flaw affects how the service processes the MD (message digest) field in an authenticated KSL start message. The service validates that OpenSSL recognizes the supplied digest name but fails to check that the name fits into a fixed 16-byte checksum context field before copying it. An authenticated KSL client can supply an oversized but OpenSSL-recognized digest identifier and write past the end of a heap allocation, corrupting adjacent memory. The issue is tracked by Fortra under advisory FI-2026-013 and classified as [CWE-787] Out-of-Bounds Write.

Critical Impact
An authenticated network attacker can trigger a heap out-of-bounds write in boks_ksllogsd, resulting in process crash and loss of logging availability.

Affected Products

Fortra boks_ksllogsd (BoKS KSL logging daemon)
Specific affected releases listed in Fortra Security Advisory FI-2026-013
Deployments exposing authenticated KSL message handling to clients

Discovery Timeline

2026-10-01 - CVE-2026-79900 published to the National Vulnerability Database
2026-10-01 - Last updated in NVD database

Technical Details for CVE-2026-79900

Vulnerability Analysis

The vulnerability resides in the KSL start message handler within boks_ksllogsd. The server reads a caller-supplied digest algorithm name from the MD field of the authenticated message. The handler calls OpenSSL to resolve the digest name and treats a successful resolution as sufficient validation. The code then copies the digest name into a fixed 16-byte buffer embedded in the checksum context structure on the heap. Because length validation is missing, any OpenSSL-recognized digest identifier longer than 16 bytes overflows the destination buffer and overwrites adjacent heap memory. The primary observed impact is loss of availability, consistent with the integrity and confidentiality impacts both being rated as None.

Root Cause

The root cause is a missing bounds check between name resolution and the copy operation. The developer assumed that OpenSSL recognition implied length conformance to the receiving buffer. OpenSSL accepts many digest identifiers whose string length exceeds 16 bytes, including aliases and longer canonical names, so the assumption does not hold.

Attack Vector

An attacker must first authenticate as a KSL client. Once authenticated, the attacker crafts a KSL start message with a MD field containing a long but OpenSSL-recognized digest name. Sending this message to boks_ksllogsd triggers the overflow. The attack is network reachable, requires low complexity, and does not require user interaction. The practical outcome is corruption of adjacent heap metadata or structures, leading to a crash of the logging daemon.

No verified public exploit code is available for CVE-2026-79900. Refer to the Fortra Security Advisory FI-2026-013 for authoritative technical details.

Detection Methods for CVE-2026-79900

Indicators of Compromise

Unexpected termination or repeated restarts of the boks_ksllogsd process
Heap corruption signatures in core dumps generated by the logging daemon
KSL start messages containing MD field values exceeding 16 bytes in packet captures
Gaps in BoKS KSL log ingestion coinciding with authenticated client connections

Detection Strategies

Inspect KSL protocol traffic for start messages with abnormally long MD field values and alert on names exceeding the 16-byte boundary.
Monitor process supervision logs for crash loops of boks_ksllogsd tied to specific client sessions.
Correlate authenticated KSL client source addresses with crash events to identify the originating account.

Monitoring Recommendations

Forward boks_ksllogsd stderr, core dump metadata, and systemd or init crash records to a central SIEM.
Baseline normal KSL message field sizes and alert on outliers in the MD field length.
Track authentication events against the KSL service and flag accounts that precede daemon crashes.

How to Mitigate CVE-2026-79900

Immediate Actions Required

Apply the fixed release identified in Fortra Security Advisory FI-2026-013 to all BoKS servers running boks_ksllogsd.
Restrict network access to the KSL logging service to known administrative source addresses.
Audit KSL client credentials and revoke any accounts that are not required for current operations.

Patch Information

Fortra has published fixed releases in advisory FI-2026-013. Administrators should consult the advisory for the exact versions that remediate the out-of-bounds write and schedule upgrades on all BoKS logging hosts. Verify the daemon version after upgrade before re-enabling external KSL client connectivity.

Workarounds

Block inbound connections to the KSL port at the host or network firewall from any address that does not require log submission.
Rotate or disable credentials for KSL client accounts that are not actively used until patching is complete.
Enable process supervision with rate-limited restarts to reduce the operational impact of crash-based denial of service.

bash

# Example: restrict KSL daemon exposure to a trusted admin subnet
iptables -A INPUT -p tcp --dport <KSL_PORT> -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport <KSL_PORT> -j DROP