Quick answers
- Is CVE-2026-48984 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-48984 being exploited in the wild.
- How severe is CVE-2026-48984?
- Medium severity, with a CVSS score of 4.7, published 18 June 2026.
- Which products and versions are affected?
- Mcdope Pam Usb <= 0.9.1.
- Is there a fix for CVE-2026-48984?
- A patch was published on 2026-05-23: Version 0.9.2 released with security hardening fixes. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-48984 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-48984?
- Check whether you run Mcdope Pam Usb at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A vulnerability exists in the xfree() memory release helper within src/mem.c of pam_usb. The function calls free() without first zeroing the buffer contents, leading to sensitive data (including one-time pad bytes) lingering in heap memory. An attacker with local access could potentially recover this material if a use-after-free condition exists or if they can utilize a heap inspection primitive. The issue is addressed in version 0.9.2 by implementing explicit_bzero() within the xfree() helper to ensure memory is cleared before being returned to the system.
Affected products
- mcdope pam_usb <= 0.9.1
Timeline
- 2026-05-23: patched: Version 0.9.2 released with security hardening fixes.
- 2026-05-24: advisory: GitHub Security Advisory GHSA-rmp6-wfrq-wrrc published.
- 2026-06-18: disclosed: CVE-2026-48984 published to the NVD.