Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds write via Graphite actions, because slotat does not ensure that an offset is within the allowed slot-map range.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds write via Graphite actions,
    because slotat does not ensure that an offset is within the allowed slot-map range. (CVE-2026-50593)

According to the versions of the graphite2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds write via Graphite actions,     because slotat does not ensure that an offset is within the allowed slot-map range.(CVE-2026-50593)

Tenable has extracted the preceding description block directly from the EulerOS graphite2 security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099523 advisory.

    Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds write via Graphite actions,     because slotat does not ensure that an offset is within the allowed slot-map range.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3140-1 advisory.

    Update to LibreOffice 26.2.5.1.

    Security issues fixed:

    - CVE-2026-4430: out-of-bounds write via crafted OOXML documents with mismatched encryption salt     parameters       (bsc#1264357).
    - CVE-2026-6039: denial of service via specially crafted DXF polyline import (bsc#1268494).
    - CVE-2026-6040: heap use-after-free when importing the blank-width characters of an ODF number format     (bsc#1268527).
    - CVE-2026-6045: heap buffer overflow via crafted EMF+ graphics import (bsc#1268497).
    - CVE-2026-6047: denial of service via heap buffer overflow in OOXML document processing (bsc#1268504).
    - CVE-2026-8356: denial of service via a specially crafted PPT file (bsc#1268522).
    - CVE-2026-8357: heap buffer overflow in Calc formula compilation (bsc#1268528).
    - CVE-2026-8358: heap buffer overflow in spreadsheet tracked-changes import (bsc#1268529).
    - CVE-2026-50593: graphite2: out-of-bounds write via Graphite actions (bsc#1267735).

    Other updates and bugfixes:

    - Update to LibreOffice 26.2.5.1.
      - Update bundled dependencies:
        * `fontconfig` 2.17.1 -> 2.18.0
        * `graphite2-minimal` 1.3.14 -> 1.3.15
        * `libcmis` 0.6.2 -> 0.6.3
        * `libgpg-error` 1.59 -> 1.61
        * `lxml` 6.1.0 -> 6.1.1
        * `md4c` 0.5.2 -> 0.5.3
        * `poppler` 26.04.0 -> 26.06.0
        * `sqlite-amalgamation` 3530000 -> 3530100
        * `xmlsec1` 1.3.9 -> 1.3.11
    - Update to LibreOffice 26.2.3.2 (PED-16098).
      - Upgraded dependencies:
        * `boost`: 1_88_0 -> 1_89_0
        * `freetype`: 2.14.1 -> 2.14.3
        * `harfbuzz`: 12.3.0 -> 12.3.2
        * `icu4c`: 77_1 -> 78.3
        * `libgpg-error`: 1.56 -> 1.59
        * `liborcus`: 0.20.1 -> 0.21.0
        * `pdfium`: 7012 -> 7471
        * `poppler`: 25.12.0 -> 26.04.0
        * `skia`: m136 -> m142
      - New bundled sources:
        * `afdko` 4.0.3
        * `antlr4-cpp-runtime` 4.13.2
        * `fast_float` 8.2.2
        * `libffi` 3.5.2
        * `lxml` 6.1.0
        * `md4c` 0.5.2
        * `meson` 1.8.3
        * `Python` 3.12.13
        * `sqlite` 3530000
        * `xmlsec1` 1.3.9
        * `xz` 5.8.3
    - Add `patch`, required to build the bundled Python on all architectures.
    - Bundling a specific Python is now required as the one we ship (3.6) is too old to build `harfbuzz`.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:2478-1 advisory.

    This update for graphite2 fixes the following issue:

    - CVE-2026-50593: Out-of-bounds write via Graphite actions (bsc#1267733).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:2474-1 advisory.

    This update for graphite2 fixes the following issue

    - CVE-2026-50593: Out-of-bounds write via Graphite actions (bsc#1267733).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:22191-1 advisory.

    This update for graphite2 fixes the following issue

    - CVE-2026-50593: Out-of-bounds write via Graphite actions (bsc#1267733).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:2477-1 advisory.

    This update for graphite2 fixes the following issue:

    - CVE-2026-50593: Out-of-bounds write via Graphite actions (bsc#1267733).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1856 advisory.

    Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds write via Graphite actions,     because slotat does not ensure that an offset is within the allowed slot-map range. (CVE-2026-50593)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of graphite2 installed on the remote host is prior to 1.3.10-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3369 advisory.

    Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds write via Graphite actions,     because slotat does not ensure that an offset is within the allowed slot-map range. (CVE-2026-50593)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8444-1 advisory.

    It was discovered that Graphite incorrectly handled memory when running certain actions. An attacker could     use this issue to cause Graphite to crash, resulting in a denial of service, or possibly execute arbitrary     code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds write via Graphite actions,     because slotat does not ensure that an offset is within the allowed slot-map range. (CVE-2026-50593)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
460437	Echo: graphite2: security update to 1.3.14-1+deb12u1	Tenable Cloud Security	Echo Local Security Checks	Local	high
460437	Echo: graphite2: security update to 1.3.14-1+deb12u1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
348033	EulerOS 2.0 SP10 : graphite2 (EulerOS-SA-2026-3693)	Nessus	Huawei Local Security Checks	Local	high
347234	EulerOS 2.0 SP10 : graphite2 (EulerOS-SA-2026-3740)	Nessus	Huawei Local Security Checks	Local	high
343644	EulerOS 2.0 SP12 : graphite2 (EulerOS-SA-2026-3340)	Nessus	Huawei Local Security Checks	Local	high
343601	EulerOS 2.0 SP12 : graphite2 (EulerOS-SA-2026-3265)	Nessus	Huawei Local Security Checks	Local	high
337014	Unity Linux 20.1070e Security Update: graphite2 (UTSA-2026-099523)	Nessus	Unity Linux Local Security Checks	Local	high
328909	SUSE SLED15: libreoffice / libreoffice-base / libreoffice-base-drivers-firebird / etc (SUSE-SU-2026:3140-1)	Nessus	SuSE Local Security Checks	Local	medium
323087	SUSE SLED15 / SLES15 Security Update : graphite2 (SUSE-SU-2026:2478-1)	Nessus	SuSE Local Security Checks	Local	high
323044	SUSE SLES12 Security Update : graphite2 (SUSE-SU-2026:2474-1)	Nessus	SuSE Local Security Checks	Local	high
322934	SUSE SLES16 Security Update : graphite2 (SUSE-SU-2026:22191-1)	Nessus	SuSE Local Security Checks	Local	high
322908	SUSE SLES15 Security Update : graphite2 (SUSE-SU-2026:2477-1)	Nessus	SuSE Local Security Checks	Local	high
322080	Amazon Linux 2023 : graphite2, graphite2-devel (ALAS2023-2026-1856)	Nessus	Amazon Linux Local Security Checks	Local	high
322023	Amazon Linux 2 : graphite2, --advisory ALAS2-2026-3369 (ALAS-2026-3369)	Nessus	Amazon Linux Local Security Checks	Local	high
321607	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : Graphite vulnerability (USN-8444-1)	Nessus	Ubuntu Local Security Checks	Local	high
318743	Linux Distros Unpatched Vulnerability : CVE-2026-50593	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-50593

high

Tenable Plugins

high

high

high

high

high

high

high

medium

high

high

high

high

high

high

high

high