CVE-2026-123975
Grid Community Toolkit globus-gss-assist before 12.9 Pre-Authentication Heap Out-of-Bounds Write
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
Grid Community Toolkit before 6.2.20261111 (globus-gss-assist before 12.9) contains a heap out-of-bounds write in globus_gss_assist_token_get_fd() triggered by SSLv2 record lengths below 3. Remote unauthenticated clients can send a crafted GSI handshake record to services like globus-gatekeeper and myproxy to corrupt heap memory and crash the service.
| CWE | CWE-787 |
| Vendor | grid community forum |
| Product | grid community toolkit |
| Published | Nov 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for grid community forum grid community toolkit
Be the first to know when new high vulnerabilities affecting grid community forum grid community toolkit are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
Grid Community Forum / Grid Community Toolkit
0 < 6.2.20261111
Grid Community Forum / globus-gss-assist
0 < 12.9
References
gridcf.org: https://gridcf.org/#2026-11-11 github.com: https://github.com/gridcf/gct/commit/3df2be4834c146bdcec90009a0f2e5771ff63cca github.com: https://github.com/gridcf/gct/releases/tag/v6.2.20261111 github.com: https://github.com/gridcf/gct/blob/v6.2.20190829/gsi/gss_assist/source/tokens_f.c vulncheck.com: https://www.vulncheck.com/advisories/grid-community-toolkit-globus-gss-assist-before-12.9-pre-authentication-heap-out-of-bounds-write
Credits
Deus Rex