CVE-2026-10717
LowCVSS 1.8Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
In openSeaChest v25.05.3, the --showSCSIDefects function has out-of-bounds writes and reads. A malicious SCSI device with a very long defect list can write defect info out of bounds.
Risk Assessment
Risk of memory corruption or sensitive data disclosure by an attacker with access to a connected SCSI device, potentially leading to crash or information leak.
Recommendation
Update openSeaChest to a patched version. Restrict tool access to trusted users and devices.
Other vulnerabilities in openSeaChest
See all- CVE-2026-10719Low
In openSeaChest v25.05.3, the --showSupportedFormats function has an out-of-bounds write. A malicious NVMe device with a bogus FLBAS byte can write 1 extra byte outside allocated memory.
- CVE-2026-10718Medium
In Seagate's openSeaChest version 26.03.0, the Trim/Unmap operation writes 16 bytes outside the allocated memory space when describing a range of LBAs to deallocate.
Original NVD description (English source)
Out of bounds write and reads in openSeaChest’s --showSCSIDefects in Seagate’s openSeaChest v25.05.3 on all supported platforms allows for writing defect information out of bounds for very large defects lists via a very bad drive with lots of defects or a maliciously crafted SCSI device’s defect response length.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS