lee1981 (@lee1981b) on X

What it is

CVE-2026-103780 is a stack-based buffer overflow (CWE-121) in Dell PowerProtect Data Domain / DD OS. Dell rates it Critical, CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and documents potential command execution by an unauthenticated remote attacker. Dell added it to advisory DSA-2026-416 (article 000515178) in revision 3.0 on 19 October 2026. The original advisory bundle dates to 1 October. The CVE record was published on 28 October.

Preconditions / Affected

Applicability depends on the release train, not on a single version comparison. Dell's remediation table gives these ranges:

• Feature Release: affected 7.7.1.0 to 8.8.0.0, fixed in 8.9.0.0 or later. The advisory prose shortens the upper bound to 8.8, and the table supplies 8.8.0.0.
• LTS2024: affected 7.13.1.0 to 7.13.1.80, fixed in 7.13.1.90 or later.
• LTS2025: affected 8.3.1.0 to 8.3.1.40, fixed in 8.3.1.50 or later.
• LTS2026: affected 8.6.1.0 to 8.6.1.20, fixed in 8.6.1.30 or later.

A fixed LTS build is not vulnerable just because it sorts below 8.9. "Or later" does not permit an unsupported jump between trains, so check Dell's current support guidance.

The CNA's machine-readable version data is unreliable. It puts literal "or later" text inside lessThan values and uses 0 as a start sentinel, and NVD repeats this. Keep the raw record and resolve applicability from Dell's narrative and table.

Dell's remediation rows also cover series appliances, Virtual Edition, APEX Protection Storage and Management Center. The exact-CVE narrative names only PowerProtect Data Domain, so confirm the deployment type and package with the product owner. Standby, disaster-recovery and replication systems may run different builds.

How it works

Dell does not disclose the vulnerable service, protocol, port, input, buffer size or fix diff. The only documented outcome is potential command execution. The execution account and root access are unverified. The page warns against borrowing the root claim from CVE-2026-86400 or the privileged-account claim from CVE-2026-86397, which sit in the same advisory.

What to do

• Record the train and full running build of every appliance, and match each to its row above. A banner may not show the running build.
• Preserve audit and access records, system and fault records, support exports, off-appliance syslog, network records and change records before any repair.
• Restrict reachable services to approved systems. The page says no CVE-specific workaround was verified, and closing a guessed port or hiding the management UI is not a demonstrated mitigation.
• Upgrade within the same supported train using Dell's current procedure. The page did not inspect the upgrade procedure, HA sequencing or rollback.
• Confirm the running build per instance after the upgrade. Judge backup success and restore integrity separately.
• Escalate to incident response only when an owner-denied command, account, configuration or integrity change lines up with unexplained access or faults. A vulnerable version alone is not evidence of exploitation.

Caveats

• KEV had no exact match in the 28 October 2026 catalogue (1,762 entries). EPSS returned no row, which means unavailable rather than zero. CISA SSVC (28 October) records Exploitation none, Automatable yes, Technical Impact total.
• No active exploitation or verified public PoC was found in the reviewed sources, and no IOCs were identified. The page frames this as a research limit, not proof of safety.
• The page's six SOC checks are proposed, not a validated detector. Log names and fields must be confirmed for the deployed DD OS version, since Dell's logging guidance cited uses DD OS 7.10 context.
• An unauthenticated exploit need not leave a normal login or DDSH command record, and may not crash a process.
• NVD is Awaiting Analysis. The unreviewed GHSA mirror shows a 0.0 default score, which means unavailable, not zero severity.