{"affected":[{"defaultStatus":"unaffected","ecosystem":"github","packageName":"gridcf/gct","product":"Grid Community Toolkit","source":"CNA: VulnCheck","vendor":"Grid Community Forum","versions":[{"lessThan":"6.2.20261111","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","ecosystem":"github","packageName":"gridcf/gct","product":"globus-gss-assist","source":"CNA: VulnCheck","vendor":"Grid Community Forum","versions":[{"lessThan":"12.9","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2026-123975","cwes":["CWE-787"],"description":"Grid Community Toolkit before 6.2.20261111 (globus-gss-assist before 12.9) contains a heap out-of-bounds write in globus_gss_assist_token_get_fd() triggered by SSLv2 record lengths below 3. Remote unauthenticated clients can send a crafted GSI handshake record to services like globus-gatekeeper and myproxy to corrupt heap memory and crash the service.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.7,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"},{"score":7.5,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1794582104332,"publishedAt":1794582104332,"references":[{"source":"CNA: VulnCheck","tags":["vendor-advisory"],"url":"https://gridcf.org/#2026-11-11"},{"source":"CNA: VulnCheck","tags":["patch"],"url":"https://github.com/gridcf/gct/commit/3df2be4834c146bdcec90009a0f2e5771ff63cca"},{"source":"CNA: VulnCheck","tags":["release-notes"],"url":"https://github.com/gridcf/gct/releases/tag/v6.2.20261111"},{"source":"CNA: VulnCheck","tags":["technical-description"],"url":"https://github.com/gridcf/gct/blob/v6.2.20190829/gsi/gss_assist/source/tokens_f.c"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/grid-community-toolkit-globus-gss-assist-before-12.9-pre-authentication-heap-out-of-bounds-write"}],"remediation":[{"kind":"fix","source":"CNA: VulnCheck","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/gridcf/gct/commit/3df2be4834c146bdcec90009a0f2e5771ff63cca"}],"revision":"678e7f2df6f140ab6bc6d7b66e629064ea65477286fa2414e85925959ac415cd","sources":[{"modifiedAt":1794582104332,"name":"CNA: VulnCheck","retrievedAt":1794582535732,"url":"https://www.cve.org/CVERecord?id=CVE-2026-123975"}],"ssvc":null,"status":"published","title":"Grid Community Toolkit globus-gss-assist before 12.9 Pre-Authentication Heap Out-of-Bounds Write","updatedAt":1794582535732}