CVE-2026-10719
LowCVSS 1.8Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
In openSeaChest v25.05.3, the --showSupportedFormats function has an out-of-bounds write. A malicious NVMe device with a bogus FLBAS byte can write 1 extra byte outside allocated memory.
Risk Assessment
Risk of memory corruption or code execution by an attacker with access to a connected NVMe device, potentially leading to system crash or privilege escalation.
Recommendation
Update openSeaChest to a patched version. Restrict tool access to trusted users and devices.
Other vulnerabilities in openSeaChest
See all- CVE-2026-10718Medium
In Seagate's openSeaChest version 26.03.0, the Trim/Unmap operation writes 16 bytes outside the allocated memory space when describing a range of LBAs to deallocate.
- CVE-2026-10717Low
In openSeaChest v25.05.3, the --showSCSIDefects function has out-of-bounds writes and reads. A malicious SCSI device with a very long defect list can write defect info out of bounds.
Original NVD description (English source)
Out of bounds write in openSeaChest’s --showSupportedFormats in Seagate’s openSeaChest v25.05.3 on all supported platforms allows for writing 1 extra byte outside of allocated memory which sets a value to 1 via a maliciously crafted NVMe device with a bogus value in the namespace FLBAS byte.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS