Executive brief
Seagate openSeaChest is a suite of command-line utilities used for managing and diagnosing storage drives. A technical flaw in how the software handles drive deallocation (Trim/Unmap) commands could allow an attacker with high-level system privileges to write data to unintended memory locations. While this requires significant existing access to the system, it could potentially lead to system instability or further compromise of the management tool.
Technical details
An out-of-bounds write (CWE-787) exists in the Trim/Unmap operation of Seagate openSeaChest v26.03.0. The vulnerability occurs when the software describes a range of Logical Block Addresses (LBAs) to deallocate, resulting in a write of 16 bytes outside of the allocated memory space. Exploitation requires local access with high privileges (PR:H). While the CVSS assessment indicates low impact to confidentiality and no direct impact to integrity or availability, out-of-bounds writes can typically be leveraged for memory corruption or potential code execution depending on the memory environment.
Affected products
- Seagate openSeaChest 26.03.0
Timeline
- 2026-06-02: disclosed: CVE published by Seagate Technology