CVE-2026-81625: NASL Vulnerability Test Buffer Overflow

CVE-2026-81625 Overview

CVE-2026-81625 is a stack buffer overflow vulnerability affecting Greenbone products that process NASL (Nessus Attack Scripting Language) vulnerability tests. A remote attacker with user-level privileges can supply a malicious or compromised NASL vulnerability test (VT) to trigger the overflow. Successful exploitation grants the attacker full access to the compromised system.

The flaw is classified under CWE-787 (Out-of-bounds Write) and requires network access with low privileges and no user interaction. Because scanning engines typically run with elevated permissions, exploitation results in high impact to confidentiality, integrity, and availability of the scanner host.

Critical Impact
A remote authenticated attacker can achieve full system compromise of the affected Greenbone scanner by supplying a crafted NASL vulnerability test that overflows a stack buffer.

Affected Products

Greenbone products processing NASL vulnerability tests (see the Greenbone Security Advisory 2026-03 for exact version ranges)

Discovery Timeline

2026-08-27 - CVE-2026-81625 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-81625

Vulnerability Analysis

The vulnerability resides in the NASL interpreter component that parses and executes vulnerability test scripts on Greenbone scanning products. NASL is the scripting language used by Greenbone (and originally Nessus) to define individual vulnerability checks. When the interpreter processes a specially crafted VT, a fixed-size stack buffer is written past its boundary.

An attacker who can submit or influence a VT delivered to the scanner can control the overflow contents. Because the overflow occurs on the stack, an attacker can overwrite the saved return address or adjacent local variables to hijack execution flow. The result is arbitrary code execution in the security context of the scanning process.

Since Greenbone scanners commonly execute with high privileges to perform authenticated scans and interact with network stacks, code execution translates directly into full system compromise.

Root Cause

The root cause is missing or insufficient bounds checking when copying data derived from a NASL VT into a stack-allocated buffer. This is a classic stack-based out-of-bounds write mapped to [CWE-787]. Untrusted script content is treated as trusted input during parsing or execution routines, allowing attacker-controlled data to exceed the destination buffer size.

Attack Vector

Exploitation requires network access to the Greenbone product and an authenticated user account with permission to load or trigger a NASL VT. The attacker either uploads a malicious VT or compromises the VT feed used by the scanner. Once the tampered VT is executed by the NASL interpreter, the overflow triggers and delivers the attacker payload.

No user interaction beyond routine scanner operation is required. Full technical detail is available in the Greenbone Security Advisory 2026-03.

Detection Methods for CVE-2026-81625

Indicators of Compromise

Unexpected NASL VT files present in the scanner's plugin or feed directories that did not originate from the official Greenbone Community or Enterprise feed.
Crash artifacts, core dumps, or abnormal termination of the NASL interpreter or scanner process.
Outbound network connections from the scanner host to untrusted destinations, particularly shortly after a scan is launched.
New user accounts, cron jobs, or persistence artifacts appearing on the scanner host.

Detection Strategies

Compare deployed VTs against the signed Greenbone feed and alert on unsigned or modified scripts.
Monitor the scanner process for segmentation faults, stack canary failures, or unexpected child process creation.
Enable file integrity monitoring on the NASL VT directories and configuration files.
Correlate scanner authentication logs with VT modification or upload events to identify low-privileged users staging malicious tests.

Monitoring Recommendations

Forward scanner host logs, process telemetry, and file integrity events to a centralized SIEM for correlation.
Alert on the scanner service spawning shells (sh, bash), interpreters (python, perl), or network utilities such as curl or nc.
Track outbound egress from the scanner subnet and treat unexpected destinations as high priority.

How to Mitigate CVE-2026-81625

Immediate Actions Required

Apply the vendor-supplied patch referenced in the Greenbone Security Advisory 2026-03 as soon as it is available for your deployment.
Restrict scanner user accounts to the minimum set of trusted administrators and remove any accounts that do not require VT execution rights.
Verify that scanners consume VTs only from the official signed Greenbone feed and disable any custom or third-party VT sources until patched.
Isolate scanner hosts on a management network segment and block inbound access from general user networks.

Patch Information

Greenbone has published details of the fix in Greenbone Security Advisory 2026-03. Administrators should consult the advisory for the exact product versions and updated packages that remediate CVE-2026-81625, then update all affected scanner instances.

Workarounds

Disable the loading of user-supplied or custom NASL VTs where operationally feasible until the patch is applied.
Enforce strict role-based access control so that only administrators can modify or upload VTs.
Place the scanner behind network access controls that restrict management-plane access to trusted jump hosts.
Monitor VT feed integrity by validating signatures before synchronization.

bash

# Configuration example: restrict VT directory permissions and verify feed signatures
chown -R gvm:gvm /var/lib/openvas/plugins
chmod -R 750 /var/lib/openvas/plugins
greenbone-feed-sync --type GVMD_DATA --verify