CVE-2026-64544: crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents

CVE-2026-64544 is a vulnerability in crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents, rated Moderate by Microsoft, with a CVSS 3.1 base score of 4.4 (Medium). An attacker can exploit it by an attacker with local access, with high privileges and without user interaction. Microsoft has not reported exploitation in the wild. The EPSS model estimates a 0.18% probability of exploitation activity in the next 30 days, higher than 7% of all scored vulnerabilities. Microsoft released the fix on 6 August 2026, outside Patch Tuesday. It affects 1 product in 1 product family (Open Source Software).

Key facts

CVE ID

CVE-2026-64544

Severity

Medium CVSS 4.4

Microsoft severity

Moderate

Exploited in the wild

No

Publicly disclosed

No

EPSS

0.18% (percentile 7%)

CISA KEV

Not listed

Released

6 August 2026

Last updated

6 August 2026

Patch Tuesday

July 2026 Patch Tuesday

Product families

Open Source Software

CVSS score and vector

Microsoft scores CVE-2026-64544 at 4.4 (temporal 4.4) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Affected products (1)

Open Source Software

NIST NVD data

NVD status

Awaiting Analysis

Published to NVD

27 July 2026

NVD last modified

6 November 2026

References

• https://git.kernel.org/stable/c/627938383761fb4334b41ebe7ef438d6b8b19d60
• https://git.kernel.org/stable/c/6acd2fbd00f9c72aebefce63fc2e73e8f3d79061
• https://git.kernel.org/stable/c/7016377699b5b25b7ec3c0bf2ec3f983c7e95f7c
• https://git.kernel.org/stable/c/803591785d33cf13b6f73ce2796e8b9e6d5e6526
• https://git.kernel.org/stable/c/89efd998470a93284b7ad5a20d4e0e3c6858ae8e
• https://git.kernel.org/stable/c/b798ada5a5d1cb4cc4cfa72074b1b463eca6c506
• https://git.kernel.org/stable/c/e162bc386e71b5412425a38ee048e8d2185491b9
• https://git.kernel.org/stable/c/f7dd32c5179d7755de18e21d5674b08f9e5cb180

Revision history

Related vulnerabilities

More from the July 2026 Patch Tuesday

• CVE-2026-57968: Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2026-57973: Windows Subsystem for Linux (WSL2) Kernel Tampering Vulnerability (Medium, CVSS 6.3)
• CVE-2026-44210: Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations (Critical, CVSS 9.9)
• CVE-2026-15043: DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text (Critical, CVSS 9.8)
• CVE-2026-17543: SQL injection in ext-pgsql via E'...' backslash breakout (Critical, CVSS 9.8)
• CVE-2026-38968: ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session identifiers in src/HTTPserver.cpp use weak time-seeded pseudo-randomness during session creation. As a result, fresh authenticated logins can receive deterministic or colliding session cookies under attacker-controlled timing. (Critical, CVSS 9.8)
• CVE-2026-53374: drm/amdgpu: zero-initialize GART table on allocation (Critical, CVSS 9.8)
• CVE-2026-53376: drm/amdkfd: Add upper bound check for num_of_nodes (Critical, CVSS 9.8)
• CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (Critical, CVSS 9.8)
• CVE-2026-53403: fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var (Critical, CVSS 9.8)
• CVE-2026-55971: Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform() (Critical, CVSS 9.8)
• CVE-2026-57433: Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record (Critical, CVSS 9.8)

All vulnerabilities of this release: July 2026 Patch Tuesday · July 2026 briefing

Sources

• Microsoft Security Update Guide: CVE-2026-64544
• NIST NVD: CVE-2026-64544
• CVE.org record: CVE-2026-64544