High-Severity Buffer Bounds Flaw in Portwell Engineering Toolkits Driver (CVE-2026-3437)
Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Mar 3, 2026
CISA published an ICS advisory for CVE-2026-3437, a high-severity memory safety issue (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer) affecting Portwell Engineering Toolkits v4.8.2. The flaw is in the Portwell Engineering Toolkits driver and could allow a local, authenticated attacker to read and write arbitrary memory, enabling privilege escalation or denial of service; CISA scored it CVSS v3.1 8.8 (High) with a local attack vector and low complexity.
The CVE record corroborates the same impact and affected version, and additionally lists a CVSS v4.0 vector consistent with high impact to confidentiality, integrity, and availability. The vulnerability was reported to CISA by Jason Huang of TXOne Networks (Cyber Threat & Product Defense Center), and the advisory notes deployment across critical infrastructure environments (including Energy and Critical Manufacturing) with worldwide exposure.
