Common Weakness Enumeration
CWE-121
AllowedStack-based Buffer Overflow
Abstraction: Variant · Status: Draft
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
6119 vulnerabilities reference this CWE, most recent first.
CVE-2026-115863 (GCVE-0-2026-115863)
Vulnerability from cvelistv5 – Published: 2026-10-23 17:35 – Updated: 2026-10-23 17:35
VLAI
EPSS
VEX
Summary
ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in get_domains in gdhcp/client.c. It copies a fixed NS_MAXDNAME (1025) bytes from a DHCPv6 DOMAIN_LIST (option 24) value into a 1026-byte stack buffer dns_name regardless of the actual option length, then walks DNS labels with an unbounded "c += jump + 1" loop. A crafted DHCPv6 REPLY with a DOMAIN_LIST option of >= 1025 non-zero bytes makes the label walk leave the buffer and read/write '.' past its end in attacker-chosen strides. An on-link attacker can trigger this without authentication via a forged Router Advertisement (O=1) and a forged DHCPv6 REPLY matching xid/CLIENTID with a long DOMAIN_LIST. The impact is unauthenticated on-link crash of connmand (runs as root). This was introduced in bb06c47.
Severity
7.6 (High)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://lore.kernel.org/connman/179274561161.8129… | third-party-advisory |
| https://git.kernel.org/pub/scm/network/connman/co… | product |
| https://git.kernel.org/pub/scm/network/connman/co… | product |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "ConnMan",
"vendor": "ConnMan",
"versions": [
{
"lessThanOrEqual": "2.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in get_domains in gdhcp/client.c. It copies a fixed NS_MAXDNAME (1025) bytes from a DHCPv6 DOMAIN_LIST (option 24) value into a 1026-byte stack buffer dns_name regardless of the actual option length, then walks DNS labels with an unbounded \"c += jump + 1\" loop. A crafted DHCPv6 REPLY with a DOMAIN_LIST option of \u003e= 1025 non-zero bytes makes the label walk leave the buffer and read/write \u0027.\u0027 past its end in attacker-chosen strides. An on-link attacker can trigger this without authentication via a forged Router Advertisement (O=1) and a forged DHCPv6 REPLY matching xid/CLIENTID with a long DOMAIN_LIST. The impact is unauthenticated on-link crash of connmand (runs as root). This was introduced in bb06c47."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T17:35:18.517Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://lore.kernel.org/connman/179274561161.81299.4579745057858200074@pm.me/"
},
{
"tags": [
"product"
],
"url": "https://git.kernel.org/pub/scm/network/connman/connman.git/tree/gdhcp/client.c"
},
{
"tags": [
"product"
],
"url": "https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=bb06c47101ca243fa5c04fb4b03fe2a12420d280"
}
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-115863",
"datePublished": "2026-10-23T17:35:18.517Z",
"dateReserved": "2026-10-23T17:35:18.141Z",
"dateUpdated": "2026-10-23T17:35:18.517Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114383 (GCVE-0-2026-114383)
Vulnerability from cvelistv5 – Published: 2026-10-21 21:45 – Updated: 2026-10-21 21:45
VLAI
EPSS
VEX
Title
TOTOLINK EX200 wireless.so cstecgi.cgi setWiFiAclAddConfig stack-based overflow
Summary
A weakness has been identified in TOTOLINK EX200 5.2.3c.7200. This impacts the function setWiFiAclAddConfig of the file /cgi-bin/cstecgi.cgi of the component wireless.so. This manipulation of the argument macAddress causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/424742 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/424742/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-114383 | third-party-advisory |
| https://vuldb.com/submit/1019883 | third-party-advisory |
| https://github.com/qwq-nm/CVE/blob/f5d61361eb7d84… | exploit |
| https://www.totolink.net/ | product |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:totolink:ex200_firmware:*:*:*:*:*:*:*:*"
],
"modules": [
"wireless.so"
],
"product": "EX200",
"vendor": "TOTOLINK",
"versions": [
{
"status": "affected",
"version": "5.2.3c.7200"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "zeroxf (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in TOTOLINK EX200 5.2.3c.7200. This impacts the function setWiFiAclAddConfig of the file /cgi-bin/cstecgi.cgi of the component wireless.so. This manipulation of the argument macAddress causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 10,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T21:45:18.906Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-424742 | TOTOLINK EX200 wireless.so cstecgi.cgi setWiFiAclAddConfig stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/424742"
},
{
"name": "VDB-424742 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/424742/cti"
},
{
"name": "CVE-2026-114383 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-114383"
},
{
"name": "Submit #1019883 | TOTOLINK EX200 V5.2.3c.7200 Stack-based Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1019883"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/qwq-nm/CVE/blob/f5d61361eb7d846479f6d76c0aa4273e9af46d27/CVE2/report.md"
},
{
"tags": [
"product"
],
"url": "https://www.totolink.net/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-21T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-21T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-21T13:31:43.000Z",
"value": "VulDB entry last update"
}
],
"title": "TOTOLINK EX200 wireless.so cstecgi.cgi setWiFiAclAddConfig stack-based overflow",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-114383",
"datePublished": "2026-10-21T21:45:18.906Z",
"dateReserved": "2026-10-21T11:26:32.468Z",
"dateUpdated": "2026-10-21T21:45:18.906Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114382 (GCVE-0-2026-114382)
Vulnerability from cvelistv5 – Published: 2026-10-21 21:30 – Updated: 2026-10-21 21:30
VLAI
EPSS
VEX
Title
TOTOLINK EX200 lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflow
Summary
A security flaw has been discovered in TOTOLINK EX200 5.2.3c.7200. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the component lan.so. The manipulation of the argument Comment results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/424741 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/424741/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-114382 | third-party-advisory |
| https://vuldb.com/submit/1019881 | third-party-advisory |
| https://github.com/qwq-nm/CVE/blob/f5d61361eb7d84… | exploit |
| https://www.totolink.net/ | product |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:totolink:ex200_firmware:*:*:*:*:*:*:*:*"
],
"modules": [
"lan.so"
],
"product": "EX200",
"vendor": "TOTOLINK",
"versions": [
{
"status": "affected",
"version": "5.2.3c.7200"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "zeroxf (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in TOTOLINK EX200 5.2.3c.7200. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the component lan.so. The manipulation of the argument Comment results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 10,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T21:30:10.698Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-424741 | TOTOLINK EX200 lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/424741"
},
{
"name": "VDB-424741 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/424741/cti"
},
{
"name": "CVE-2026-114382 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-114382"
},
{
"name": "Submit #1019881 | TOTOLINK EX200 V5.2.3c.7200 Stack-based Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1019881"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/qwq-nm/CVE/blob/f5d61361eb7d846479f6d76c0aa4273e9af46d27/CVE1/report.md"
},
{
"tags": [
"product"
],
"url": "https://www.totolink.net/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-21T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-21T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-21T13:31:38.000Z",
"value": "VulDB entry last update"
}
],
"title": "TOTOLINK EX200 lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflow",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-114382",
"datePublished": "2026-10-21T21:30:10.698Z",
"dateReserved": "2026-10-21T11:26:28.357Z",
"dateUpdated": "2026-10-21T21:30:10.698Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113744 (GCVE-0-2026-113744)
Vulnerability from cvelistv5 – Published: 2026-10-21 01:30 – Updated: 2026-10-21 01:30
VLAI
EPSS
VEX
Title
Tenda AC19 httpd Web Management Service SetFirewallCfg formSetFirewallCfg stack-based overflow
Summary
A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the component httpd Web Management Service. Such manipulation of the argument firewallEn leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/422925 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/422925/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-113744 | third-party-advisory |
| https://vuldb.com/submit/1018542 | third-party-advisory |
| https://github.com/henrythekingofuk/TendaCVE | exploit |
| https://www.tenda.com.cn/ | product |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:h:tenda:ac19:*:*:*:*:*:*:*:*"
],
"modules": [
"httpd Web Management Service"
],
"product": "AC19",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "16.03.10.07"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Zeming Hu (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the component httpd Web Management Service. Such manipulation of the argument firewallEn leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed publicly and may be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 10,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T01:30:24.075Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-422925 | Tenda AC19 httpd Web Management Service SetFirewallCfg formSetFirewallCfg stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/422925"
},
{
"name": "VDB-422925 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/422925/cti"
},
{
"name": "CVE-2026-113744 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-113744"
},
{
"name": "Submit #1018542 | Tenda AC19 V16.03.10.07 Stack-based Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1018542"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/henrythekingofuk/TendaCVE"
},
{
"tags": [
"product"
],
"url": "https://www.tenda.com.cn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-20T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-20T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-20T18:58:39.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tenda AC19 httpd Web Management Service SetFirewallCfg formSetFirewallCfg stack-based overflow",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-113744",
"datePublished": "2026-10-21T01:30:24.075Z",
"dateReserved": "2026-10-20T16:53:34.154Z",
"dateUpdated": "2026-10-21T01:30:24.075Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112373 (GCVE-0-2026-112373)
Vulnerability from cvelistv5 – Published: 2026-10-19 23:00 – Updated: 2026-10-20 13:51
VLAI
EPSS
VEX
Title
H3C Magic NX15 usrlist sub_416874 stack-based overflow
Summary
A security vulnerability has been detected in H3C Magic NX15 NX15V100R017. This impacts the function sub_416874 of the file /usr/bin/usrlist. Such manipulation leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 13:51 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/422421 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/422421/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-112373 | third-party-advisory |
| https://vuldb.com/submit/983540 | third-party-advisory |
| https://github.com/XxingGoD/H3C-NX15-R017-Vulns/t… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| H3C | Magic NX15 |
Affected:
NX15V100R017
cpe:2.3:o:h3c:magic_nx15_firmware:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112373",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T13:51:47.857218Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T13:51:59.801Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:h3c:magic_nx15_firmware:*:*:*:*:*:*:*:*"
],
"product": "Magic NX15",
"vendor": "H3C",
"versions": [
{
"status": "affected",
"version": "NX15V100R017"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "starlight (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in H3C Magic NX15 NX15V100R017. This impacts the function sub_416874 of the file /usr/bin/usrlist. Such manipulation leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.8,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T23:00:16.156Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-422421 | H3C Magic NX15 usrlist sub_416874 stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/422421"
},
{
"name": "VDB-422421 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/422421/cti"
},
{
"name": "CVE-2026-112373 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-112373"
},
{
"name": "Submit #983540 | H3C Magic NX15 NX15V100R017 Denial of Service",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/983540"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/XxingGoD/H3C-NX15-R017-Vulns/tree/main/H3C/NX15R017/usrlist_stack_overflow_dos"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-19T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-19T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-19T18:04:14.000Z",
"value": "VulDB entry last update"
}
],
"title": "H3C Magic NX15 usrlist sub_416874 stack-based overflow",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-112373",
"datePublished": "2026-10-19T23:00:16.156Z",
"dateReserved": "2026-10-19T15:59:01.321Z",
"dateUpdated": "2026-10-20T13:51:59.801Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112281 (GCVE-0-2026-112281)
Vulnerability from cvelistv5 – Published: 2026-10-19 13:55 – Updated: 2026-10-19 14:20
VLAI
EPSS
VEX
Title
libaribb24 through 1.0.3 Stack Buffer Overflow via decoder_handle_csi
Summary
libaribb24 (aribb24) through 1.0.3 contains a stack-based buffer overflow vulnerability in decoder_handle_csi() in src/decoder.c that allows attackers to write past a fixed 256-entry array by supplying unbounded CSI parameter bytes. Attackers can embed a caption statement with a CSI introducer and over 256 parameter bytes in media files or broadcast streams to crash FFmpeg or VLC or corrupt the return address.
Severity
6.1 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 14:20 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haindpwn/aribb24-caption-data-… | third-party-advisory |
| https://github.com/nkoriyama/aribb24/blob/v1.0.3/… | technical-description |
| https://www.vulncheck.com/advisories/libaribb24-t… | third-party-advisory |
| https://hackmd.io/@haindpwn/cve-2026-112280-11228… | exploit |
Date Public
2026-10-17 17:52
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112281",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T14:20:02.109030Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T14:20:24.874Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@haindpwn/cve-2026-112280-112281-aribb24-caption-data-unit-and-csi-oob-write"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/nkoriyama/aribb24",
"defaultStatus": "unaffected",
"product": "aribb24",
"repo": "https://github.com/nkoriyama/aribb24",
"vendor": "nkoriyama",
"versions": [
{
"lessThanOrEqual": "1.0.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-17T17:52:37.000Z",
"descriptions": [
{
"lang": "en",
"value": "libaribb24 (aribb24) through 1.0.3 contains a stack-based buffer overflow vulnerability in decoder_handle_csi() in src/decoder.c that allows attackers to write past a fixed 256-entry array by supplying unbounded CSI parameter bytes. Attackers can embed a caption statement with a CSI introducer and over 256 parameter bytes in media files or broadcast streams to crash FFmpeg or VLC or corrupt the return address."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T13:55:26.323Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@haindpwn/aribb24-caption-data-unit-and-csi-oob-write"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/nkoriyama/aribb24/blob/v1.0.3/src/decoder.c"
},
{
"name": "VulnCheck Advisory: libaribb24 through 1.0.3 Stack Buffer Overflow via decoder_handle_csi",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/libaribb24-through-1.0.3-stack-buffer-overflow-via-decoder-handle-csi"
}
],
"title": "libaribb24 through 1.0.3 Stack Buffer Overflow via decoder_handle_csi",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112281",
"datePublished": "2026-10-19T13:55:26.323Z",
"dateReserved": "2026-10-19T13:25:30.868Z",
"dateUpdated": "2026-10-19T14:20:24.874Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112257 (GCVE-0-2026-112257)
Vulnerability from cvelistv5 – Published: 2026-10-19 21:37 – Updated: 2026-10-21 20:09
VLAI
EPSS
VEX
Title
Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033)
Summary
A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 14:47 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://access.redhat.com/security/cve/CVE-2026-112257 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2555574 | issue-trackingx_refsource_REDHAT |
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 6 |
cpe:/o:redhat:enterprise_linux:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/o:redhat:enterprise_linux:9
|
Date Public
2026-10-12 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112257",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T14:47:14.486852Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T14:47:40.624Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "gimp",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unknown",
"packageName": "gimp",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "gimp",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "gimp:2.8/gimp",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "gimp",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank Alexey Khairov (codem4ster), Konstantin Talgarenko (Marcusov), and Nikolay Kravtsov (Kolya080808) for reporting this issue."
}
],
"datePublic": "2026-10-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T20:09:47.104Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-112257"
},
{
"name": "RHBZ#2555574",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555574"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-15T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-10-12T00:00:00.000Z",
"value": "Made public."
}
],
"title": "Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033)",
"workarounds": [
{
"lang": "en",
"value": "Avoid opening or browsing untrusted PSD files in GIMP. If GIMP is unused, remove the gimp package."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-121: Stack-based Buffer Overflow"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-112257",
"datePublished": "2026-10-19T21:37:19.467Z",
"dateReserved": "2026-10-19T13:14:33.431Z",
"dateUpdated": "2026-10-21T20:09:47.104Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112063 (GCVE-0-2026-112063)
Vulnerability from cvelistv5 – Published: 2026-10-18 12:19 – Updated: 2026-10-19 19:38
VLAI
EPSS
VEX
Title
libstrophe through 0.14.0 Stack-Based Buffer Overflow via SCRAM Salt in SCRAM_Hi
Summary
libstrophe through 0.14.0 contains a stack-based buffer overflow vulnerability in SCRAM_Hi that allows malicious XMPP servers to overflow a 128-byte stack buffer by sending an oversized SCRAM salt. Attackers can send a server-first-message whose s= attribute decodes to more than 124 bytes, aborting the client or overwriting stack memory in NDEBUG builds.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 19:37 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haindpwn/libstrophe-scram-salt… | third-party-advisory |
| https://github.com/strophe/libstrophe/blob/0.14.0… | technical-description |
| https://github.com/strophe/libstrophe/blob/0.14.0… | technical-description |
| https://www.vulncheck.com/advisories/libstrophe-t… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| strophe | libstrophe |
Affected:
0 , ≤ 0.14.0
(semver)
|
Date Public
2026-10-17 17:52
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112063",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T19:37:54.956028Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:38:04.100Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@haindpwn/libstrophe-scram-salt-stack-overflow"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/strophe/libstrophe",
"defaultStatus": "unaffected",
"product": "libstrophe",
"repo": "https://github.com/strophe/libstrophe",
"vendor": "strophe",
"versions": [
{
"lessThanOrEqual": "0.14.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-17T17:52:50.000Z",
"descriptions": [
{
"lang": "en",
"value": "libstrophe through 0.14.0 contains a stack-based buffer overflow vulnerability in SCRAM_Hi that allows malicious XMPP servers to overflow a 128-byte stack buffer by sending an oversized SCRAM salt. Attackers can send a server-first-message whose s= attribute decodes to more than 124 bytes, aborting the client or overwriting stack memory in NDEBUG builds."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T12:19:52.787Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@haindpwn/libstrophe-scram-salt-stack-overflow"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/strophe/libstrophe/blob/0.14.0/src/scram.c"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/strophe/libstrophe/blob/0.14.0/src/sasl.c"
},
{
"name": "VulnCheck Advisory: libstrophe through 0.14.0 Stack-Based Buffer Overflow via SCRAM Salt in SCRAM_Hi",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/libstrophe-through-0.14.0-stack-based-buffer-overflow-via-scram-salt-in-scram-hi"
}
],
"title": "libstrophe through 0.14.0 Stack-Based Buffer Overflow via SCRAM Salt in SCRAM_Hi",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112063",
"datePublished": "2026-10-18T12:19:52.787Z",
"dateReserved": "2026-10-18T12:00:08.233Z",
"dateUpdated": "2026-10-19T19:38:04.100Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112062 (GCVE-0-2026-112062)
Vulnerability from cvelistv5 – Published: 2026-10-18 12:19 – Updated: 2026-10-19 17:56
VLAI
EPSS
VEX
Title
lwIP through 2.2.1 Stack Out-of-Bounds Write via mDNS Search Response Handler
Summary
lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdns_handle_response that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers with RDLENGTH below 6 during a service search, overflowing a 256-byte stack buffer and crashing the device.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 17:56 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haindpwn/lwip-mdns-search-resu… | third-party-advisory |
| https://github.com/lwip-tcpip/lwip/commit/ab2f69c… | patch |
| https://github.com/lwip-tcpip/lwip/blob/STABLE-2_… | technical-description |
| https://www.vulncheck.com/advisories/lwip-through… | third-party-advisory |
| https://hackmd.io/@haindpwn/cve-2026-112062-lwip-… | exploit |
Impacted products
Date Public
2026-10-17 18:49
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112062",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T17:56:07.508494Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T17:56:37.505Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@haindpwn/cve-2026-112062-lwip-mdns-search-result-domain-oob-write"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://savannah.nongnu.org/projects/lwip/",
"defaultStatus": "unaffected",
"product": "lwIP",
"repo": "https://git.savannah.nongnu.org/git/lwip.git",
"vendor": "lwIP",
"versions": [
{
"lessThanOrEqual": "2.2.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lwip_project:lwip:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.2.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-17T18:49:36.000Z",
"descriptions": [
{
"lang": "en",
"value": "lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdns_handle_response that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers with RDLENGTH below 6 during a service search, overflowing a 256-byte stack buffer and crashing the device."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T12:19:52.023Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@haindpwn/lwip-mdns-search-result-domain-oob-write"
},
{
"tags": [
"patch"
],
"url": "https://github.com/lwip-tcpip/lwip/commit/ab2f69c7d8980c01cdd67ed4b23ac61118ed0205"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/lwip-tcpip/lwip/blob/STABLE-2_2_1_RELEASE/src/apps/mdns/mdns.c"
},
{
"name": "VulnCheck Advisory: lwIP through 2.2.1 Stack Out-of-Bounds Write via mDNS Search Response Handler",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lwip-through-2.2.1-stack-out-of-bounds-write-via-mdns-search-response-handler"
}
],
"title": "lwIP through 2.2.1 Stack Out-of-Bounds Write via mDNS Search Response Handler",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112062",
"datePublished": "2026-10-18T12:19:52.023Z",
"dateReserved": "2026-10-18T12:00:07.926Z",
"dateUpdated": "2026-10-19T17:56:37.505Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111711 (GCVE-0-2026-111711)
Vulnerability from cvelistv5 – Published: 2026-10-16 17:40 – Updated: 2026-10-16 21:16
VLAI
EPSS
VEX
Title
Netcore NR256CN through 1.5.140116 Pre-Auth Stack Overflow via Boa user_ok()
Summary
Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user_ok() function, which copies Basic-auth usernames with unbounded strcpy() calls into 64-byte stack buffers. Unauthenticated attackers can send a username longer than 63 bytes to any protected /router/*.cgi route to crash the main Boa process or potentially execute code.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 20:53 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/lukadqq/netcore-router-public-… | third-party-advisory |
| https://www.vulncheck.com/advisories/netcore-nr25… | third-party-advisory |
Impacted products
Date Public
2026-10-16 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111711",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T20:53:29.394899Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T21:16:42.070Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NR256CN",
"vendor": "Netcore",
"versions": [
{
"lessThanOrEqual": "1.5.140116",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zhou Ao"
},
{
"lang": "en",
"type": "finder",
"value": "Yin Luxing"
},
{
"lang": "en",
"type": "finder",
"value": "Lu Fangzhou"
},
{
"lang": "en",
"type": "finder",
"value": "Liu Xin"
}
],
"datePublic": "2026-10-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server\u0027s user_ok() function, which copies Basic-auth usernames with unbounded strcpy() calls into 64-byte stack buffers. Unauthenticated attackers can send a username longer than 63 bytes to any protected /router/*.cgi route to crash the main Boa process or potentially execute code."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:40:01.282Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/lukadqq/netcore-router-public-refs/blob/a44d562736b41c944223297e9144d2ad7fa2aff1/2026.10.15-netcore-nr256cn-basic-auth-stack-overflow.md"
},
{
"name": "VulnCheck Advisory: Netcore NR256CN through 1.5.140116 Pre-Auth Stack Overflow via Boa user_ok()",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netcore-nr256cn-through-1.5.140116-pre-auth-stack-overflow-via-boa-user-ok"
}
],
"title": "Netcore NR256CN through 1.5.140116 Pre-Auth Stack Overflow via Boa user_ok()",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111711",
"datePublished": "2026-10-16T17:40:01.282Z",
"dateReserved": "2026-10-16T14:31:23.221Z",
"dateUpdated": "2026-10-16T21:16:42.070Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation MIT-10
Operation
Build and Compilation
Strategy: Environment Hardening
- Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking.
- D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
Mitigation
Architecture and Design
Use an abstraction library to abstract away risky APIs. Not a complete solution.
Mitigation
Implementation
Implement and perform bounds checking on input.
Mitigation
Implementation
Do not use dangerous functions such as gets. Use safer, equivalent functions which check for boundary errors.
Mitigation MIT-11
Operation
Build and Compilation
Strategy: Environment Hardening
- Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.
- Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking.
- For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].
No CAPEC attack patterns related to this CWE.