// disclosure

Security.

Every security advisory MayteraOS has found and fixed, in one searchable table, newest fix first. Below the table: how to report a bug, and how to get a build with the fix.

Advisories

43 advisories to date, each tied to the build that introduced it and the build that fixed it. “Reach” marks whether the row carries a network-reachable attack path (a LAN-only path, such as DHCP spoofing, is marked local). Sorted by fixed-in build, newest first.

ID Component Type Severity Reach Affected Fixed in Description
0051 SMB opening handshake (net/smb.c) Unauthenticated negotiation Medium Remote ≤2580 2581 Nothing authenticated the opening negotiation of a file-share connection, so an attacker who can modify packets could edit it undetected. What resistance there was to being pushed onto weaker settings came from the encryption option, so relaxing encryption for an old server also gave up tamper detection.
0049 SMB plaintext transfer (net/smb.c) Cleartext transmission High Remote ≤2576 2577 File-share traffic crossed the network unencrypted by default, and encryption could be silently downgraded by an on-path attacker.
0048 USB volume file-open permission check (proc/fdlayer.c) Missing authorization High Local ≤2574 2575 Opening a file on a USB drive skipped the permission check entirely, letting any app read or overwrite other users’ files on it.
0047 SMB message signing (net/smb.c) Missing authentication High Remote ≤2570 2571 File-share network traffic was never cryptographically signed, so a network attacker could tamper with it or impersonate the server undetected.
0046 AI file protection on USB drives (fs/escrow_guard.c) Protection mechanism failure Medium Local 2559–2569 2570 The AI assistant’s recycle-only data protection did not apply to files on a USB drive, destroying data with no recovery and no on-screen notice.
0045 SMB first-connection identity (net/smb.c) Improper authentication High Remote ≤2568 2569 A file server could silently downgrade a named sign-in to its anonymous guest account, and the client did not check for it.
0044 SMB connection lifetime and identity (net/smb.c) Insecure default / failing open High Local ≤2565 2566 Any app could drop every live file-share connection, which could then silently reconnect anonymously under the same display name; the identity gap this left open was closed 4 October 2026.
0043 Network/mounted volume file write (proc/fdlayer.c) Improper initialization High Local ≤2563 2564 Opening an existing file for writing on a network share or mounted volume without asking to empty it still replaced the whole file, destroying everything else in it.
0042 AI file protection chokepoint (fs/escrow_guard.c) Protection mechanism failure Medium Local 2559–2561 2562 Two file-write paths could bypass the AI assistant’s recycle-only data protection, destroying data with no recovery or notice.
0041 Kernel address-space insert (mm/demand.c) Inefficient algorithmic complexity High Remote ≤2550 2551 Kernel memory-mapping records were never merged, so heap growth from any web page made page-fault handling scale with the square of the heap size.
0040 Userland shared allocator (userland/libc/stdlib.c) Inefficient algorithmic complexity High Remote ≤2548 2549 The free-block search in the allocator every app shares made allocation slow down with the square of memory in use, reachable from any web page or any memory-heavy app.
0039 HTML tree construction (browser engine) Inefficient algorithmic complexity High Remote ≤2545 2546 Deeply nested HTML made page construction cost scale with the square of nesting depth, and uncapped teardown recursion could crash the browser.
0029 DOM lookup, getElementById (browser engine) Uncontrolled recursion High Remote ≤2542 2543 Deeply nested HTML plus a getElementById call caused uncontrolled recursion that crashed the browser.
0028 HTTP/2 fetch loop (net/http2.c) Resource consumption Low Remote ≤2541 (dormant) 2542 A slow HTTP/2 peer could hold a shared fetch slot indefinitely; ranked Low because HTTP/2 is not negotiated on a shipping image.
0027 TLS record receive (net/tls/tls.c) Resource consumption High Remote ≤2541 2542 A malicious TLS server could stream skippable records to stall a connection’s timeout indefinitely.
0026 Progressive JPEG decoder (gui/jpeg.c) Excessive iteration High Remote ≤2541 2542 A crafted progressive JPEG forced roughly 157,000 redundant decode passes, burning over two minutes of kernel CPU time.
0025 JavaScript Math.log (browser engine) Unbounded loop High Remote ≤2541 2542 Math.log(Infinity) and four related calls froze the browser permanently on any web page.
0024 CSS colour parse (browser engine) Unbounded loop High Remote ≤2539 2540 A CSS colour value with a leading-dot fraction (.18 rather than 0.18) froze the browser permanently on any web page.
0050 Saved network-share credentials (fs/perms.c) Insufficiently protected credentials High Local ≤2489 2490 The file storing saved network-share logins was readable by every program on the machine, and it held each share password as plain text.
0037 Debug input-injection marker (drivers/testinput.c) Insecure default Low Local ≤2397 2398 A build-time debug input channel had no check for its own absence; a release build cannot reach it today, so this is a build-integrity gap, not a live hole.
0036 Ambient USB-serial access (fs/perms.c) Missing authorization Medium Local ≤2396 2397 Any app could open and drive an attached USB serial device (3D printer, microcontroller, modem) with no consent.
0035 Screenshot file-drop trigger (compositor) Missing authorization High Local ≤2392 2394 Any app could trigger a full-screen capture, including open password fields, by dropping a file, with no consent and no on-screen indicator.
0034 Device-node open ordering (proc/fdlayer.c) Missing authorization Medium Local ≤2391 2392 Opening any device node bypassed the permission check entirely, for every device node in the system, not just one.
0033 Shared-memory map (ipc/shm.c) Missing authorization High Local ≤2391 2392 Any app could map and read, and sometimes write, another process’s shared memory region with no ownership check.
0032 Legacy raw-index TCP calls (net/tcp.c) Incorrect authorization High Local ≤2391 2392 Any app could read, write or close another app’s TCP connection, including the SSH server’s, by guessing its raw table index.
0031 Input-injection syscall (proc/syscall.c) Missing authorization High Local ≤2391 2392 Any app could inject a synthetic keystroke to self-approve a privilege prompt or drive another app’s window.
0030 Keyboard-read syscall (proc/syscall.c) Missing authorization High Local ≤2391 2392 Any unprivileged app could drain the system-wide keyboard buffer, including the password typed into the privilege-elevation prompt.
0015 DHCP transaction ID (net/dhcp.c) Weak randomness Medium Local not recoverable 924 Every machine sent its first DHCP request with the same constant transaction ID, making spoofed replies easier.
0016 Syscall pointer validation (proc/syscall.c) Missing authorization High Local before 2026-07-28 918 20 pointer-taking syscalls bypassed the kernel’s pointer-validation chokepoint; 4 allowed a write to an address the caller did not own.
0014 IPv4 receive path (net/ip.c) Integer underflow High Remote ≤825 826 A crafted 60-byte frame underflowed a length check into a 65,496-byte over-read, reachable from any host on the network before DHCP completes.
0013 JPEG decoder, Huffman table build (gui/jpeg.c) Out-of-bounds write High Local ≤825 826 A crafted JPEG with an invalid Huffman code-length table caused a roughly 259 KB out-of-bounds write.
0012 NFS3 client read (net/nfs.c) Out-of-bounds write High Remote ≤823 824 A malicious or compromised NFS server’s reply length overflowed the client’s read buffer.
0011 Extended-attribute parser (fs/xattr.c) Out-of-bounds read Medium Local ≤822 823 A crafted or corrupt filesystem extended-attribute block caused a heap over-read on lookup.
0010 HTTP/2 frame parser (net/http2.c) NULL dereference High Remote ≤821 822 A single malicious HTTP/2 frame caused a NULL pointer dereference and a whole-system crash, pre-authentication.
0009 AAC / M4A parser (media/aac.c) Out-of-bounds read Medium Local ≤818 819 A crafted .m4a/.mp4 file’s sample table caused out-of-bounds reads during playback.
0008 HTTP chunked decode (net/https.c) Integer overflow High Remote ≤816 817 A malicious HTTPS server could overflow a 32-bit chunk-size check into a large out-of-bounds write on any chunked response.
0007 TLS handshake parse (net/tls/tls.c) Out-of-bounds read High Remote ≤815 816 A malicious or on-path TLS server could trigger an out-of-bounds read on every outbound HTTPS handshake.
0006 JPEG decoder, header parse (gui/jpeg.c) Out-of-bounds read / write High Local ≤813 814 Crafted JPEG header fields caused large out-of-bounds reads and an in-allocation write that corrupted decoder state.
0005 PNG decoder (gui/png.c) Integer overflow High Local ≤812 813 Crafted PNG dimensions overflowed size math into an undersized buffer, then overran it during colour conversion.
0004 FAT/VFAT long filename reassembly (fs/fat.c) Out-of-bounds write High Local ≤809 810 A crafted FAT long filename overran its 256-byte buffer, an out-of-bounds write reachable from any app that lists a directory.
0003 ELF loader validation (exec/elf.c) Integer overflow High Local ≤807 808 A crafted ELF binary’s header fields overflowed load-size math into an out-of-bounds heap write.
0002 DHCP reply parse (net/dhcp.c) Out-of-bounds read Medium Local ≤805 806 A spoofed runt DHCP reply drove option parsing past the packet buffer.
0001 ext2 directory parse (fs/ext2.c) Out-of-bounds read Medium Local ≤793 794 A crafted ext2 directory entry caused a heap over-read during a file lookup.
Two reserved numbers are not rows above. MAYTERA-SEC-2026-0017 documents a live adversarial test that proved an existing TLS check (CertificateVerify) is load-bearing; no vulnerable code shipped and no fix was needed, so it was not given a row. 0018 to 0023 were withdrawn after an internal numbering collision and were never published; a build gate fails if any of them is still cited in the source tree. 0038 records a deliberately added capability (consented cross-application input injection), not a defect. No advisory data was removed to reach 43 rows; these three numbers were never rows in the first place.

Report a bug

Found a security issue, or any other bug? Open an issue on the project’s GitHub repository:

github.com/referefref/maytera-os/issues

That repository is the only public MayteraOS repository. Include the build number shown on the desktop, what you expected, and what happened.

How to update

There is currently no published release with a working desktop: the one disk image published so far, v2.0.2, build 2285, boots but crashes on login, and it predates every fix in the table above. Until a new verified release ships, the only way to run a build with these fixes is to build MayteraOS from source and compare the build number the desktop reports against the “Fixed in” column above. See Downloads for the current state of prebuilt images.