Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV L L N N P N L H 6.9 .0013 2.3 —
AFFECTED Product Versions Fixed libsmi unspecified —
TIMELINE Oct 15 Reserved by VulnCheck Oct 15 Published (CNA: VulnCheck) Oct 16 EXPLOIT PUBLISHED — CVE-2026-111137 (amartin755 libsmi). Public exploit reference added.
libsmi through 0.5.0 contains an out-of-bounds write vulnerability in smiValueAsString() in lib/smi.c that allows attackers to overflow a fixed 1024-byte static buffer through hex rendering of OCTET STRING values. Attackers can supply a crafted MIB with an OCTET STRING DEFVAL of 512 or more octets and a leading 0x00 byte to corrupt adjacent library globals and crash smidump or other consumers.
| Date | Event | Detail |
|---|---|---|
| October 15, 2026 | Reserved | Reserved by VulnCheck |
| October 15, 2026 | Published | Published (CNA: VulnCheck) |
| October 16, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-111137 (amartin755 libsmi). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| amartin755 | libsmi | — | — | — |
Authoritative record: CVE-2026-111137 at cve.org
Vendors: amartin755
Weaknesses: CWE-787
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-111137 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
