CVE-2026-8484 Details
Description
A heap buffer overflow vulnerability exists in the Jansi JNI "ioctl()" wrapper due to a lack of size verification for the argument array before the system call. This can lead to heap corruption and application crashes (DoS). All versions are believed to be vulnerable. This project is unmaintained at the time of CVE assignment.
A heap buffer overflow vulnerability has been identified in the FuseSource Jansi library, specifically in the Java Native Interface (JNI) 'ioctl()' wrapper. This vulnerability arises from inadequate size verification of the argument array before the system call, potentially leading to heap corruption and application crashes, causing a denial-of-service condition. All versions of the Jansi library through 2.4.3 are believed to be vulnerable. At the time of this CVE assignment, the Jansi project is unmaintained.
Users are advised to update their dependencies to use 'org.jline:jansi' instead, as the Jansi library is no longer maintained.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 16, 2026CISA-ADP
Assessed Jun 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cert.pl/en/posts/2026/06/CVE-2026-8484 | [email protected] | AdvisoryVendor |
| https://github.com/fusesource/jansi/tree/master | [email protected] | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-122 | Heap-based Buffer Overflow | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FuseSource jansi | <= 2.4.3 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 16, 2026 | New CVE Received | [email protected] |