Security readout for executives and security teams
Plain-English summary
CVE-2026-24873 is a high-severity out-of-bounds read in Rinnegatamante lpp-vita before r6. In business terms, affected builds could expose sensitive data or destabilize applications using this library. The public record is sparse, and there is no cited evidence of active exploitation.
Executive priority
Treat as a targeted high-priority dependency update, not an internet-wide emergency. Prioritize teams shipping or embedding lpp-vita before r6, especially in user-facing workflows where local user interaction is plausible.
Technical view
The CVE identifies CWE-125 in lpp-vita before r6. CVSS 3.1 is 7.8 with local attack vector, low complexity, no privileges required, and user interaction required. The source does not describe the exact trigger or vulnerable code path, but references a GitHub pull request.
Likely exposure
Exposure is likely limited to environments that build, package, or run Rinnegatamante lpp-vita versions before r6. The CVSS vector indicates exploitation is local and requires user interaction. The public sources do not identify downstream products or distribution channels.
Exploitation context
This CVE is not listed as KEV in the provided data, and no source states active exploitation. The attack context is local, no privileges required, with user interaction required. Public information does not provide exploit maturity or real-world abuse details.
Researcher notes
Evidence is limited to the CVE record and an upstream GitHub pull request. The record states out-of-bounds read but does not specify trigger conditions. Validate by code review and version comparison against r6, without assuming exploitation details beyond the CVSS vector.
Mitigation direction
- Upgrade lpp-vita to r6 or later if available.
- Review the linked upstream pull request for vendor remediation context.
- Check vendor project guidance for release and backport details.
- Prioritize replacement of pre-r6 builds in distributed packages.
Validation and detection
- Inventory projects and packages using lpp-vita.
- Confirm deployed or bundled lpp-vita versions are r6 or later.
- Review dependency manifests and build artifacts for embedded pre-r6 code.
- Track the CVE record and upstream pull request for updates.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-24873 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H1.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/Rinnegatamante/lpp-vita/pull/82CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.