Tanium Endpoint Configuration Toolset: Heap-based buffer overflow in index-cx

Summary

A heap-based buffer overflow in the index-cx component of the Tanium Endpoint Configuration Toolset Solution (ECT) affects several ECT releases and index-cx versions. An attacker with local access to a system running the Tanium Client and low privileges can execute unauthorized code in the context of the Tanium Client. No user interaction is required, and the CVSS score is 7.8 (High).

Affected

• Endpoint Configuration Toolset Solution 2025H1: prior to Update 26 (v1.51 to v1.51.60)
• Endpoint Configuration Toolset Solution 2025H2: prior to Update 16 (v1.59 to v1.59.50)
• Endpoint Configuration Toolset Solution 2026H1: prior to Update 9 (v1.71 to v1.71.25)
• index-cx 3.9 prior to 3.9.520; 3.11 prior to 3.11.443; 3.14 prior to 3.14.921 and 3.14.917; 3.15 prior to 3.15.2420; 3.16 prior to 3.16.984

Fixed in

• Endpoint Configuration Toolset Solution Update 26 (v1.51.60) and later
• Endpoint Configuration Toolset Solution Update 16 (v1.59.50) and later
• Endpoint Configuration Toolset Solution Update 9 (v1.71.25) and later
• index-cx: versions at or above the 'prior to' values listed in the vendor advisory

Workaround

None.

Exploitation

• No known exploitation reported.
• No public exploit found.

Our recommendation

• Upgrade ECT to Update 26, Update 16 or Update 9 (or later) and index-cx to the versions listed above.
• On-prem customers using ECM: deploy one of the Manifests 2.13.327, 2.21.324 or 2.35.252 (or later) to all endpoints via Change Management.
• Tanium Cloud customers using ECM: deploy one of the Manifests 2.40.187, 2.42.142, 2.44.102 or 2.46.75 (or later) to all endpoints via Change Management.
• Inventory ECT and index-cx versions on all endpoints and limit local low-privileged accounts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Tanium Security Bulletin TAN-2026-057 security.tanium.com
• VulDB entry 427508 vuldb.com
• OffSeq Threat Radar: CVE-2026-108307 radar.offseq.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:07.