CVE-2026-41907 uuid: Missing buffer bounds check in `v3`/`v5`/`v6` when `buf` is provided

🗓️ 24 Apr 2026 18:09:24Reported by GitHub_MType

CVE-2026-41907: Missing buffer bounds check in v3, v5, v6 with external buffers; partial writes fixed in 14.0.0.

Reporter	Title	Published	Views	Family All 50
IBM Security Bulletins	Security Bulletin: IBM Edge Data Collector uses uuid-8.3.2.tgz, uuid-9.0.1.tgz which is vulnerable to CVE-2026-41907	29 May 202610:36	–	ibm
IBM Security Bulletins	Security Bulletin: TDI is vulnerable to do not reject out of range writes due to uuid-11.1.0 - CVE-2026-41907	25 May 202611:29	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in uuid-3.3.2.tgz	9 Jun 202615:07	–	ibm
IBM Security Bulletins	Security Bulletin: There is a vulnerability in uuid-9.0.1.tgz used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-41907)	29 May 202609:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses uuid-9.0.1.tgz which is vulnerable to CVE-2026-41988, CVE-2026-41907	1 Jun 202608:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses multiple third party dependencies which is vulnerable to multiple CVEs.	3 Jun 202607:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses uuid-9.0.1.tgz which is vulnerable to CVE-2026-41988, CVE-2026-41907	1 Jun 202611:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in uuid (CVE-2026-41907)	31 May 202616:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses uuid-7.0.3.tgz, uuid-9.0.1.tgz which is vulnerable to CVE-2026-41907	29 May 202608:47	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been found in IBM Verify Identity Access Digital Credentials	12 Jun 202601:05	–	ibm

[
  {
    "vendor": "uuidjs",
    "product": "uuid",
    "versions": [
      {
        "version": "< 14.0.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq

24 Apr 2026 18:09Current

CVSS 49.3

EPSS0.00019