{"id":"CVE-2026-7310","state":"PUBLISHED","title":"A heap-based buffer overflow vulnerability exists in XML","description":"A heap-based buffer overflow vulnerability exists in XML\nparser functionality in the HiDraw. An authenticated\nmalicious user with local access can exploit this\nvulnerability using a specially crafted XML file which may\nlead to memory corruption and potential arbitrary code\nexecution. Successful exploitation could result in\napplication crashes (denial of service) and compromise the\nconfidentiality and integrity of the affected system.","publishedAt":"2026-05-26T11:43:41.155Z","updatedAt":"2026-05-26T14:42:15.647Z","severity":{"score":4.4,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N","source":"Hitachi Energy"},"assigner":"Hitachi Energy","products":["Hitachi Energy MACH HiDraw"],"affected":[{"vendor":"Hitachi Energy","product":"MACH HiDraw","defaultStatus":"unaffected","versions":[{"version":"9.0","status":"affected","lessThan":"9.22","versionType":"custom"}]}],"references":["https://publisher.hitachienergy.com/preview?DocumentID=8DBD000248&LanguageCode=en&DocumentPartId=&Action=Launch"],"weaknesses":["CWE-122"],"ingestedAt":"2026-10-29T20:13:07.220Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/7xxx/CVE-2026-7310.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-7310","state":"PUBLISHED","datePublished":"2026-05-26T11:43:41.155Z","dateUpdated":"2026-05-26T14:42:15.647Z","assignerShortName":"Hitachi Energy","assignerOrgId":"e383dce4-0c27-4495-91c4-0db157728d17","dateReserved":"2026-04-28T12:37:08.600Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A heap-based buffer overflow vulnerability exists in XML\nparser functionality in the HiDraw. An authenticated\nmalicious user with local access can exploit this\nvulnerability using a specially crafted XML file which may\nlead to memory corruption and potential arbitrary code\nexecution. Successful exploitation could result in\napplication crashes (denial of service) and compromise the\nconfidentiality and integrity of the affected system."}],"affected":[{"vendor":"Hitachi Energy","product":"MACH HiDraw","defaultStatus":"unaffected","versions":[{"version":"9.0","status":"affected","lessThan":"9.22","versionType":"custom"}]}],"references":[{"url":"https://publisher.hitachienergy.com/preview?DocumentID=8DBD000248&LanguageCode=en&DocumentPartId=&Action=Launch"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"LOCAL","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"ACTIVE","vulnConfidentialityImpact":"LOW","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"MEDIUM","baseScore":4.4,"vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-122","lang":"en","description":"CWE-122 Heap-based buffer overflow","type":"CWE"}]}],"providerMetadata":{"shortName":"Hitachi Energy","orgId":"e383dce4-0c27-4495-91c4-0db157728d17","dateUpdated":"2026-05-26T11:43:41.155Z"},"impacts":[{"capecId":"CAPEC-100","descriptions":[{"lang":"en","value":"CAPEC-100 Overflow Buffers"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.2"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-05-26T14:31:07.539083Z","id":"CVE-2026-7310","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-05-26T14:42:15.647Z"}}]}}}