Quick answers
- Is CVE-2026-44711 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-44711 being exploited in the wild.
- How severe is CVE-2026-44711?
- High severity, with a CVSS score of 7.9, published 27 May 2026.
- Which products and versions are affected?
- Mcdope Pam Usb < 0.8.7.
- Is there a fix for CVE-2026-44711?
- A patch was published on 2026-05-27: Fix released in version 0.8.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-44711 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-44711?
- Check whether you run Mcdope Pam Usb at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
Multiple vulnerabilities exist in src/pad.c of pam_usb due to insecure file handling. First, the module uses stat() on the pad directory, allowing a user to replace it with a symlink to an attacker-controlled directory to bypass hardware authentication. Second, the module uses fopen() on temporary pad files without O_NOFOLLOW, allowing a local user to create a symlink that causes the PAM module (running as root) to truncate and corrupt arbitrary system files during authentication. Finally, a partial read vulnerability in the pad comparison function can lead to uninitialized memory being used in authentication checks. These issues are resolved in version 0.8.7 by switching to lstat(), implementing O_NOFOLLOW flags, and enforcing strict read size checks.
Affected products
- mcdope pam_usb < 0.8.7
Timeline
- 2026-05-07: advisory: GitHub security advisory published by maintainer
- 2026-05-27: disclosed: CVE published to NVD
- 2026-05-27: patched: Fix released in version 0.8.7