CVE-2026-7179

OSPG binwalk WinCE Extraction Plugin winceextract.py read_null_terminated_string path traversal

View on CVE.org
Published Apr 27, 2026 CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Description
A security vulnerability has been detected in OSPG binwalk up to 2.4.3. This vulnerability affects the function read_null_terminated_string of the file src/binwalk/plugins/winceextract.py of the component WinCE Extraction Plugin. Such manipulation of the argument self.file_name leads to path traversal. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. The project maintainer confirms this issue: "I accept the existence of the Path Traversal vulnerability. However, as stated in the Github link, it reached EOL and as a result no actions should be expected." The GitHub repository mentions, that "[u]sers and contributors should migrate to binwalk v3." This vulnerability only affects products that are no longer supported by the maintainer.

Analysis

AI-generated

Technical impact

A path traversal flaw exists in the WinCE Extraction Plugin’s read_null_terminated_string function, allowing any local user to manipulate the target file name argument and cause the plugin to resolve file paths outside the intended directory. The vulnerability can lead to reading arbitrary local files and therefore violates data confidentiality. The weakness is classified as CWE‑22.

Affected Systems

OSPG binwalk versions up to 2.4.3 are affected, and the project maintainer has terminated support for these releases. Users are directed to migrate to binwalk v3 or later, which removes the vulnerable plugin.

Risk and Exploitability

The CVSS score of 4.8 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, implying limited public exploitation. The attack vector is strictly local; an attacker must have the ability to run binwalk on the target system to take advantage of the path traversal bug.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to binwalk v3 or later to eliminate the vulnerable plugin
  • If an upgrade is not possible, disable the winceextract plugin or prevent its execution from the local environment
  • Restrict local user privileges so that only trusted personnel can run binwalk, thereby limiting the window of exploitation

Generated by OpenCVE AI on April 28, 2026 at 12:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Ospg
Ospg binwalk
Vendors & Products Ospg
Ospg binwalk
Type Values Removed Values Added
Description A security vulnerability has been detected in OSPG binwalk up to 2.4.3. This vulnerability affects the function read_null_terminated_string of the file src/binwalk/plugins/winceextract.py of the component WinCE Extraction Plugin. Such manipulation of the argument self.file_name leads to path traversal. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. The project maintainer confirms this issue: "I accept the existence of the Path Traversal vulnerability. However, as stated in the Github link, it reached EOL and as a result no actions should be expected." The GitHub repository mentions, that "[u]sers and contributors should migrate to binwalk v3." This vulnerability only affects products that are no longer supported by the maintainer.
Title OSPG binwalk WinCE Extraction Plugin winceextract.py read_null_terminated_string path traversal
Weaknesses CWE-22
References
Metrics cvssV2_0

{'score': 4.3, 'vector': 'AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Apr 29, 2026, 2:04 PM
Reserved
Apr 27, 2026, 8:31 AM

View source JSON

Updated
Apr 29, 2026, 2:04 PM

JSON

Status
Deferred
Published
Apr 27, 2026, 11:16 PM
Modified
Jul 24, 2026, 8:10 AM

View source JSON

No data.

Updated
Apr 28, 2026, 1:00 PM

JSON