CVE-2026-41907 uuid: Missing buffer bounds check in `v3`/`v5`/`v6` when `buf` is provided
The uuid library allows out-of-bounds writes when external buffers are provided, potentially leading to memory corruption or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41907?
CVE-2026-41907 is a high-severity memory corruption vulnerability in uuidjs uuid, published on 24 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.
Which versions are affected by CVE-2026-41907?
It affects 1 product.
Products include Uuidjs Uuid.
How do I fix CVE-2026-41907?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-41907 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-41907 exists.
Other vulnerabilities in uuidjs uuid
Sources
Also known as CLEANSTART-2026-FA47344, CLEANSTART-2026-SX19522, CLEANSTART-2026-ZG01610, CLSA-2026-1778805966, CLSA-2026-1782089806, CLSA-2026-1782089807 and 43 more.