Quest NetVault Backup StnzCreateKey Numeric Truncation Error Denial-of-Service Vulnerability

November 6th, 2026
ZDI-26-888 ZDI-CAN-28743

CVE ID

CVE-2026-13269

CVSS Score

7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Vendors

Quest

Affected Products

NetVault Backup

Vulnerability Details

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Quest NetVault Backup. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the StnzCreateKey function. The issue results from the lack of proper validation of user-supplied data, which can result in a numeric truncation error before allocating a buffer. An attacker can leverage this vulnerability to create a denial-of-service condition on the system.

Additional Details

Fixed in NetVault version 14.1.3
https://support.quest.com/technical-documents/netvault/14.1.3/release-notes/2#TOPIC-2383658


Disclosure Timeline

  • 2026-04-23 - Vulnerability reported to vendor
  • 2026-11-06 - Coordinated public release of advisory
  • 2026-11-06 - Advisory Updated

Credit

06fe5fd2bc53027c4a3b7e395af0b850e7b8a044

Back to Advisories