Common Weakness Enumeration

CWE-121

Weakness Allowed

Stack-based Buffer Overflow

Abstraction: Variant · Status: Draft

API response cwe.mitre.org

The product writes past the end of a buffer that was allocated on the stack.

Mapping guidance

This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.

Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Relationships and members
ChildOf: CWE-788 · View CWE-1000
ChildOf: CWE-787 · View CWE-1000
Modes of introduction
Implementation
Detection methods

Fuzzing

Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs - either randomly or algorithmically - and dynamically invoking the code with those inputs. Even with random inputs, it is often capable of generating unexpected results such as crashes, memory corruption, or resource consumption. Fuzzing effectively produces repeatable test cases that clearly indicate bugs, which helps developers to diagnose the issues.

Effectiveness: High

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Effectiveness: High

Automated Dynamic Analysis

Use tools that are integrated during compilation to insert runtime error-checking mechanisms related to memory safety errors, such as AddressSanitizer (ASan) for C/C++ [REF-1518].

Effectiveness: Moderate

Crafted inputs are necessary to reach the code containing the error, such as generated by fuzzers. Also, these tools may reduce performance, and they only report the error condition - not the original mistake that led to the error.

Notes

Terminology

There is significant inconsistency regarding the "buffer overflow" term, which can have multiple interpretations and uses. Many people mean "writing past the end of a buffer." Others mean "writing past the end of a buffer, or before the beginning of a buffer." Still others might include "read" in the term.

Relationship

Stack-based buffer overflows can instantiate in return address overwrites, stack pointer overwrites or frame pointer overwrites. They can also be considered function pointer overwrites, array index overwrites or write-what-where condition, etc.

Content history
Submission: CLASP · 2006-07-19 · CWE Draft 3
Modification: Eric Dalci · Cigital · 2008-07-01 · CWE 1.0

updated Potential_Mitigations, Time_of_Introduction

Modification: · KDM Analytics · 2008-08-01 · CWE 1.0

added/updated white box definitions

Modification: CWE Content Team · MITRE · 2008-09-08 · CWE 1.0

updated Alternate_Terms, Applicable_Platforms, Background_Details, Common_Consequences, Relationships, Other_Notes, Taxonomy_Mappings, Weakness_Ordinalities

Modification: CWE Content Team · MITRE · 2009-01-12 · CWE 1.2

updated Common_Consequences, Relationships

Modification: KDM Analytics · 2009-07-17 · CWE 1.5

Improved the White_Box_Definition

Modification: CWE Content Team · MITRE · 2009-07-27 · CWE 1.5

updated Potential_Mitigations, White_Box_Definitions

Modification: CWE Content Team · MITRE · 2009-10-29 · CWE 1.6

updated Relationships

Modification: CWE Content Team · MITRE · 2010-02-16 · CWE 1.8

updated References

Modification: CWE Content Team · MITRE · 2011-06-01 · CWE 1.13

updated Common_Consequences

Modification: CWE Content Team · MITRE · 2012-05-11 · CWE 2.2

updated Demonstrative_Examples, References, Relationships

Modification: CWE Content Team · MITRE · 2012-10-30 · CWE 2.3

updated Demonstrative_Examples, Potential_Mitigations

Modification: CWE Content Team · MITRE · 2014-07-30 · CWE 2.8

updated Relationships, Taxonomy_Mappings

Modification: CWE Content Team · MITRE · 2017-11-08 · CWE 3.0

updated Background_Details, Causal_Nature, Likelihood_of_Exploit, References, Relationships, Taxonomy_Mappings, White_Box_Definitions

Modification: CWE Content Team · MITRE · 2018-03-27 · CWE 3.1

updated References

Modification: CWE Content Team · MITRE · 2019-01-03 · CWE 3.2

updated Relationships

Modification: CWE Content Team · MITRE · 2019-09-19 · CWE 3.4

updated References

Modification: CWE Content Team · MITRE · 2020-02-24 · CWE 4.0

updated Relationships

Modification: CWE Content Team · MITRE · 2020-06-25 · CWE 4.1

updated Common_Consequences

Modification: CWE Content Team · MITRE · 2021-03-15 · CWE 4.4

updated Demonstrative_Examples, References

Modification: CWE Content Team · MITRE · 2021-07-20 · CWE 4.5

updated Demonstrative_Examples

Modification: CWE Content Team · MITRE · 2022-06-28 · CWE 4.8

updated Observed_Examples

Modification: CWE Content Team · MITRE · 2023-04-27 · CWE 4.11

updated Detection_Factors, Potential_Mitigations, References, Relationships, Time_of_Introduction

Modification: CWE Content Team · MITRE · 2023-06-29 · CWE 4.12

updated Mapping_Notes, Relationships

Modification: CWE Content Team · MITRE · 2025-04-03 · CWE 4.17

updated Applicable_Platforms

Modification: CWE Content Team · MITRE · 2025-09-09 · CWE 4.18

updated Affected_Resources, Functional_Areas, References

Modification: CWE Content Team · MITRE · 2025-12-11 · CWE 4.19

updated Alternate_Terms, Applicable_Platforms, Detection_Factors, Other_Notes, References, Relationship_Notes, Terminology_Notes

Modification: CWE Content Team · MITRE · 2026-01-21 · CWE 4.19.1

updated Relationships

Modification: CWE Content Team · MITRE · 2026-10-28 · CWE 5.0

updated Description, Diagram

6403 vulnerabilities reference this CWE, most recent first.

CVE-2026-127099 (GCVE-0-2026-127099)

Vulnerability from cvelistv5 – Published: 2026-11-12 17:54 – Updated: 2026-11-12 19:28
VLAI
Title
Sssd: sssd: stack buffer overflow during rsa certificate-to-ssh key conversion
Summary
A flaw was found in SSSD's conversion of X.509 certificate RSA public keys to SSH keys. Missing size checks before copying RSA components into fixed-size stack buffers can cause a stack buffer overflow. An attacker able to supply a certificate with oversized RSA components that passes the configured certificate checks can cause denial of service and corrupt SSH responder memory.
Severity
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 19:20 UTC
CWE
  • CWE-121 - Stack-based Buffer Overflow
Assigner
redhat CNA under the redhat root
CNA scorecard B 82/100 over 1207 records in the last 180 days details
References
URL Tags
https://access.redhat.com/security/cve/CVE-2026-127099 vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2572590 issue-trackingx_refsource_REDHAT
Impacted products
Date Public
2026-11-12 16:36
Credits
Red Hat would like to thank Priyank Nigam (Microsoft Cloud Security) for reporting this issue.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-127099",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-12T19:20:05.637588Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-12T19:28:54.851Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "sssd",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_els:6"
          ],
          "defaultStatus": "affected",
          "packageName": "sssd",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_els:7"
          ],
          "defaultStatus": "affected",
          "packageName": "sssd",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "sssd",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "sssd",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift/ose-rhel-coreos-8",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift/ose-rhel-coreos-9",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:5"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift/ose-rhel-coreos-9",
          "product": "Red Hat OpenShift Container Platform 5",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Priyank Nigam (Microsoft Cloud Security) for reporting this issue."
        }
      ],
      "datePublic": "2026-11-12T16:36:54.495Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in SSSD\u0027s conversion of X.509 certificate RSA public keys to SSH keys. Missing size checks before copying RSA components into fixed-size stack buffers can cause a stack buffer overflow. An attacker able to supply a certificate with oversized RSA components that passes the configured certificate checks can cause denial of service and corrupt SSH responder memory."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-12T17:54:58.008Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-127099"
        },
        {
          "name": "RHBZ#2572590",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572590"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-15T14:06:08.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-11-12T16:36:54.495Z",
          "value": "Made public."
        }
      ],
      "title": "Sssd: sssd: stack buffer overflow during rsa certificate-to-ssh key conversion",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-121: Stack-based Buffer Overflow"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-127099",
    "datePublished": "2026-11-12T17:54:58.008Z",
    "dateReserved": "2026-11-12T14:41:14.737Z",
    "dateUpdated": "2026-11-12T19:28:54.851Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-126831 (GCVE-0-2026-126831)

Vulnerability from cvelistv5 – Published: 2026-11-12 17:27 – Updated: 2026-11-13 15:40
VLAI
Title
Cpio: cpio: stack-based buffer overflow in write_out_tar_header() with long usernames/groupnames
Summary
A flaw was found in cpio. A local user can cause a Denial of Service (DoS) by triggering a stack-based buffer overflow when creating archives in tar or ustar formats. When archiving files owned by users or groups with names exceeding 32 characters, cpio copies these names into fixed-size memory without verifying their length. This unbounded copy corrupts stack memory and causes the application to crash.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 15:40 UTC
CWE
  • CWE-121 - Stack-based Buffer Overflow
Assigner
redhat CNA under the redhat root
CNA scorecard B 82/100 over 1207 records in the last 180 days details
References
URL Tags
https://access.redhat.com/security/cve/CVE-2026-126831 vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2571893 issue-trackingx_refsource_REDHAT
Impacted products
Date Public
2026-11-07 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-126831",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-13T15:40:33.975265Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T15:40:46.559Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "cpio",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_els:6"
          ],
          "defaultStatus": "affected",
          "packageName": "cpio",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_els:7"
          ],
          "defaultStatus": "affected",
          "packageName": "cpio",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "cpio",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "cpio",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "cpio",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2026-11-07T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in cpio. A local user can cause a Denial of Service (DoS) by triggering a stack-based buffer overflow when creating archives in tar or ustar formats. When archiving files owned by users or groups with names exceeding 32 characters, cpio copies these names into fixed-size memory without verifying their length. This unbounded copy corrupts stack memory and causes the application to crash."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-12T17:27:16.588Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-126831"
        },
        {
          "name": "RHBZ#2571893",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571893"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-11T21:04:42.617Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-11-07T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Cpio: cpio: stack-based buffer overflow in write_out_tar_header() with long usernames/groupnames",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-121: Stack-based Buffer Overflow"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-126831",
    "datePublished": "2026-11-12T17:27:16.588Z",
    "dateReserved": "2026-11-11T21:04:08.843Z",
    "dateUpdated": "2026-11-13T15:40:46.559Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-126258 (GCVE-0-2026-126258)

Vulnerability from cvelistv5 – Published: 2026-11-11 21:31 – Updated: 2026-11-12 15:27
VLAI
Summary
A stack-based buffer overflow vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.7 may allow an unauthenticated attacker with wad port access to crash proxy or ZTNA sessions via crafted HTTP or HTTPS requests.
Severity
7.1 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 14:10 UTC
CWE
  • CWE-121 - Execute unauthorized code or commands
Assigner
fortinet CNA under the mitre root
CNA scorecard C 72/100 over 145 records in the last 180 days details
References
Impacted products
Vendor Product Version
Fortinet FortiOS Affected: 8.0.0
Affected: 7.6.7
    cpe:2.3:o:fortinet:fortios:8.0.0:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortios:7.6.7:*:*:*:*:*:*:*
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-126258",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-12T14:10:05.875958Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-12T15:27:53.484Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:o:fortinet:fortios:8.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.6.7:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiOS",
          "vendor": "Fortinet",
          "versions": [
            {
              "status": "affected",
              "version": "8.0.0"
            },
            {
              "status": "affected",
              "version": "7.6.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A stack-based buffer overflow vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.7 may allow an unauthenticated attacker with wad port access to crash proxy or ZTNA sessions via crafted HTTP or HTTPS requests."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "Execute unauthorized code or commands",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T21:31:50.602Z",
        "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
        "shortName": "fortinet"
      },
      "references": [
        {
          "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-272",
          "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-272"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to FortiOS version 8.0.1 or above\nUpgrade to FortiOS version 7.6.8 or above"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
    "assignerShortName": "fortinet",
    "cveId": "CVE-2026-126258",
    "datePublished": "2026-11-11T21:31:50.602Z",
    "dateReserved": "2026-11-10T20:10:09.146Z",
    "dateUpdated": "2026-11-12T15:27:53.484Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-126239 (GCVE-0-2026-126239)

Vulnerability from cvelistv5 – Published: 2026-11-11 21:31 – Updated: 2026-11-12 15:31
VLAI
Summary
A stack-based buffer overflow vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to crash the FSSO subsystem via crafted http requests
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 14:32 UTC
CWE
  • CWE-121 - Execute unauthorized code or commands
Assigner
fortinet CNA under the mitre root
CNA scorecard C 72/100 over 145 records in the last 180 days details
References
Impacted products
Vendor Product Version
Fortinet FortiAuthenticator Affected: 8.0.0 , ≤ 8.0.3 (semver)
Affected: 6.6.0 , ≤ 6.6.10 (semver)
    cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-126239",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-12T14:32:33.301986Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-12T15:31:42.952Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiAuthenticator",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "8.0.3",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.10",
              "status": "affected",
              "version": "6.6.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A stack-based buffer overflow vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to crash the FSSO subsystem via crafted http requests"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "Execute unauthorized code or commands",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T21:31:35.102Z",
        "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
        "shortName": "fortinet"
      },
      "references": [
        {
          "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-254",
          "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-254"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to FortiAuthenticator version 8.0.4 or above\nUpgrade to FortiAuthenticator version 6.6.11 or above"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
    "assignerShortName": "fortinet",
    "cveId": "CVE-2026-126239",
    "datePublished": "2026-11-11T21:31:35.102Z",
    "dateReserved": "2026-11-10T20:09:37.231Z",
    "dateUpdated": "2026-11-12T15:31:42.952Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-126223 (GCVE-0-2026-126223)

Vulnerability from cvelistv5 – Published: 2026-11-11 21:30 – Updated: 2026-11-13 05:01
VLAI
Summary
A stack-based buffer overflow vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11 may allow an authenticated administrator to execute unauthorized code or commands or cause a denial of service via specially crafted JSON-RPC requests.
Severity
7.2 (High)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 00:00 UTC
CWE
  • CWE-121 - Execute unauthorized code or commands
Assigner
fortinet CNA under the mitre root
CNA scorecard C 72/100 over 145 records in the last 180 days details
References
Impacted products
Vendor Product Version
Fortinet FortiManager Affected: 8.0.0 , ≤ 8.0.1 (semver)
Affected: 7.6.0 , ≤ 7.6.7 (semver)
Affected: 7.4.0 , ≤ 7.4.11 (semver)
    cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*
Create a notification for this product.
Fortinet FortiManager Cloud Affected: 8.0.0 , ≤ 8.0.1 (semver)
Affected: 7.6.0 , ≤ 7.6.7 (semver)
Affected: 7.4.1 , ≤ 7.4.11 (semver)
    cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*
Create a notification for this product.
Fortinet FortiAnalyzer Affected: 8.0.0 , ≤ 8.0.1 (semver)
Affected: 7.6.0 , ≤ 7.6.7 (semver)
Affected: 7.4.0 , ≤ 7.4.11 (semver)
    cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*
    cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*
Create a notification for this product.
Fortinet FortiAnalyzer Cloud Affected: 8.0.0 , ≤ 8.0.1 (semver)
Affected: 7.6.0 , ≤ 7.6.7 (semver)
Affected: 7.4.1 , ≤ 7.4.11 (semver)
    cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-126223",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-12T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T05:01:06.521Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiManager",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "8.0.1",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.6.7",
              "status": "affected",
              "version": "7.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.4.11",
              "status": "affected",
              "version": "7.4.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiManager Cloud",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "8.0.1",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.6.7",
              "status": "affected",
              "version": "7.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.4.11",
              "status": "affected",
              "version": "7.4.1",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiAnalyzer",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "8.0.1",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.6.7",
              "status": "affected",
              "version": "7.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.4.11",
              "status": "affected",
              "version": "7.4.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiAnalyzer Cloud",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "8.0.1",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.6.7",
              "status": "affected",
              "version": "7.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.4.11",
              "status": "affected",
              "version": "7.4.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A stack-based buffer overflow vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11 may allow an authenticated administrator to execute unauthorized code or commands or cause a denial of service via specially crafted JSON-RPC requests."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "Execute unauthorized code or commands",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T21:30:34.728Z",
        "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
        "shortName": "fortinet"
      },
      "references": [
        {
          "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-238",
          "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-238"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to FortiManager version 8.0.2 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager version 7.4.12 or above\nUpgrade to FortiManager Cloud version 8.0.2 or above\nUpgrade to FortiManager Cloud version 7.6.8 or above\nUpgrade to FortiManager Cloud version 7.4.12 or above\nUpgrade to FortiAnalyzer version 8.0.2 or above\nUpgrade to FortiAnalyzer version 7.6.8 or above\nUpgrade to FortiAnalyzer version 7.4.12 or above\nUpgrade to FortiAnalyzer Cloud version 8.0.2 or above\nUpgrade to FortiAnalyzer Cloud version 7.6.8 or above\nUpgrade to FortiAnalyzer Cloud version 7.4.12 or above"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
    "assignerShortName": "fortinet",
    "cveId": "CVE-2026-126223",
    "datePublished": "2026-11-11T21:30:34.728Z",
    "dateReserved": "2026-11-10T20:08:32.601Z",
    "dateUpdated": "2026-11-13T05:01:06.521Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-126048 (GCVE-0-2026-126048)

Vulnerability from cvelistv5 – Published: 2026-11-10 16:58 – Updated: 2026-11-10 16:58
VLAI
Title
Gwenhywfar 4.99.8beta before 5.14.2 Stack Buffer Overflow via GWEN_TLV_Buffer_To_DB()
Summary
Gwenhywfar 4.99.8beta before 5.14.2 contains a stack-based buffer overflow in GWEN_TLV_Buffer_To_DB() in src/parser/tlv.c when decoding BER-TLV tags into a fixed 128-byte buffer. Attackers can supply a record with about 127 or more tag continuation bytes or a truncated multi-byte tag, such as via a malicious chip card's EF_SSD file read by libchipcard's ZKA driver, to crash the application.
Severity
5.1 (Medium)
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
4.6 (Medium)
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE
  • CWE-121 - Stack-based Buffer Overflow
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 8176 records in the last 180 days details
References
Impacted products
Vendor Product Version
Martin Preuss Gwenhywfar Affected: 4.99.8beta , < 5.14.2 (custom)
Create a notification for this product.
Date Public
2026-11-09 00:00
Credits
Deus Rex
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/aqbanking/gwenhywfar",
          "product": "Gwenhywfar",
          "repo": "https://github.com/aqbanking/gwenhywfar",
          "vendor": "Martin Preuss",
          "versions": [
            {
              "lessThan": "5.14.2",
              "status": "affected",
              "version": "4.99.8beta",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Deus Rex"
        }
      ],
      "datePublic": "2026-11-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Gwenhywfar 4.99.8beta before 5.14.2 contains a stack-based buffer overflow in GWEN_TLV_Buffer_To_DB() in src/parser/tlv.c when decoding BER-TLV tags into a fixed 128-byte buffer. Attackers can supply a record with about 127 or more tag continuation bytes or a truncated multi-byte tag, such as via a malicious chip card\u0027s EF_SSD file read by libchipcard\u0027s ZKA driver, to crash the application."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "PHYSICAL",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "HIGH",
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T16:58:03.611Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/aqbanking/gwenhywfar/commit/ed8e2f8cdc27fd5c1b629cf9c1f6b93b2e009757"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/aqbanking/gwenhywfar/commit/6b50388e6b4a96f02d3d56e1d7747405fa881f39"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://www.aquamaniac.de/rdm/projects/gwenhywfar/files"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/aqbanking/gwenhywfar/blob/424949d0c6e61028eaccd6e46e4c0c41931c2b2f/src/parser/tlv.c#L629-L655"
        },
        {
          "name": "VulnCheck Advisory: Gwenhywfar 4.99.8beta before 5.14.2 Stack Buffer Overflow via GWEN_TLV_Buffer_To_DB()",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/gwenhywfar-4.99-8beta-before-5.14.2-stack-buffer-overflow-via-gwen-tlv-buffer-to-db"
        }
      ],
      "title": "Gwenhywfar 4.99.8beta before 5.14.2 Stack Buffer Overflow via GWEN_TLV_Buffer_To_DB()",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-126048",
    "datePublished": "2026-11-10T16:58:03.611Z",
    "dateReserved": "2026-11-10T16:53:12.633Z",
    "dateUpdated": "2026-11-10T16:58:03.611Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124561 (GCVE-0-2026-124561)

Vulnerability from cvelistv5 – Published: 2026-11-09 03:15 – Updated: 2026-11-10 17:52 Unsupported When Assigned
VLAI
Title
D-Link DIR-878 HNAP prog.cgi SetVLANSettings stack-based overflow
Summary
A vulnerability was determined in D-Link DIR-878 1.20B05. This impacts the function SetVLANSettings of the file prog.cgi of the component HNAP Handler. Executing a manipulation of the argument VID can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This vulnerability only affects products that are no longer supported by the maintainer.
Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:X/RC:R
7.5 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:X/RC:R
SSVC
Exploitation: poc Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 16:41 UTC
CWE
Assigner
VulDB CNA under the mitre root
CNA scorecard B 83/100 over 3850 records in the last 180 days details
References
URL Tags
https://vuldb.com/vuln/432893 vdb-entrytechnical-description
https://vuldb.com/vuln/432893/cti signaturepermissions-required
https://vuldb.com/cve/CVE-2026-124561 third-party-advisory
https://vuldb.com/submit/1035617 third-party-advisory
https://github.com/Zimo-666/DIR-878-cves/tree/mai… broken-linkexploit
https://www.dlink.com/ product
Impacted products
Vendor Product Version
D-Link DIR-878 Affected: 1.20B05
    cpe:2.3:h:d-link:dir-878:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
ha ha-yang (VulDB User)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-124561",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T16:41:04.146300Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T17:52:34.534Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:h:d-link:dir-878:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "HNAP Handler"
          ],
          "product": "DIR-878",
          "vendor": "D-Link",
          "versions": [
            {
              "status": "affected",
              "version": "1.20B05"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "ha ha-yang (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was determined in D-Link DIR-878 1.20B05. This impacts the function SetVLANSettings of the file prog.cgi of the component HNAP Handler. Executing a manipulation of the argument VID can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This vulnerability only affects products that are no longer supported by the maintainer."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.8,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-119",
              "description": "Memory Corruption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T03:15:50.227Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-432893 | D-Link DIR-878 HNAP prog.cgi SetVLANSettings stack-based overflow",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/432893"
        },
        {
          "name": "VDB-432893 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/432893/cti"
        },
        {
          "name": "CVE-2026-124561 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-124561"
        },
        {
          "name": "Submit #1035617 | D-Link DIR-878 1.20B05 Stack-based Buffer Overflow",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/1035617"
        },
        {
          "tags": [
            "broken-link",
            "exploit"
          ],
          "url": "https://github.com/Zimo-666/DIR-878-cves/tree/main/03-settriggeradic-vlan-stack-overflow"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://www.dlink.com/"
        }
      ],
      "tags": [
        "unsupported-when-assigned"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-08T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-11-08T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-11-08T15:52:25.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "D-Link DIR-878 HNAP prog.cgi SetVLANSettings stack-based overflow",
      "x_generator": [
        "VulDB PVTS v202611"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-124561",
    "datePublished": "2026-11-09T03:15:50.227Z",
    "dateReserved": "2026-11-08T14:46:56.088Z",
    "dateUpdated": "2026-11-10T17:52:34.534Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123385 (GCVE-0-2026-123385)

Vulnerability from cvelistv5 – Published: 2026-11-10 18:22 – Updated: 2026-11-13 18:11
VLAI
Title
Microsoft Office Excel Remote Code Execution Vulnerability
Summary
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 21:03 UTC
CWE
  • CWE-121 - Stack-based Buffer Overflow
Assigner
microsoft CNA under the mitre root
CNA scorecard B 82/100 over 4930 records in the last 180 days details
References
Impacted products
Vendor Product Version
Microsoft Microsoft 365 Apps for Enterprise Affected: 16.0.1 , < https://aka.ms/OfficeSecurityReleases (custom)
Create a notification for this product.
Microsoft Microsoft Office LTSC 2021 Affected: 16.0.1 , < 16.0.14334.21048 (custom)
Create a notification for this product.
Microsoft Microsoft Office LTSC 2024 Affected: 16.0.0 , < 16.0.17932.21140 (custom)
Create a notification for this product.
Date Public
2026-11-10 16:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-123385",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T21:03:34.857492Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T21:11:07.829Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "32-bit Systems",
            "x64-based Systems"
          ],
          "product": "Microsoft 365 Apps for Enterprise",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "https://aka.ms/OfficeSecurityReleases",
              "status": "affected",
              "version": "16.0.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "32-bit Systems",
            "x64-based Systems"
          ],
          "product": "Microsoft Office LTSC 2021",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "16.0.14334.21048",
              "status": "affected",
              "version": "16.0.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "32-bit Systems",
            "x64-based Systems"
          ],
          "product": "Microsoft Office LTSC 2024",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "16.0.17932.21140",
              "status": "affected",
              "version": "16.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:office_2021:*:*:*:*:long_term_servicing_channel:*:*:*",
                  "versionEndExcluding": "16.0.14334.21048",
                  "versionStartIncluding": "16.0.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:office_2024:*:*:*:*:long_term_servicing_channel:*:*:*",
                  "versionEndExcluding": "16.0.17932.21140",
                  "versionStartIncluding": "16.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*",
                  "versionEndExcluding": "https://aka.ms/OfficeSecurityReleases",
                  "versionStartIncluding": "16.0.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-11-10T16:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121: Stack-based Buffer Overflow",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T18:11:01.366Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Microsoft Office Excel Remote Code Execution Vulnerability",
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-123385"
        }
      ],
      "title": "Microsoft Office Excel Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2026-123385",
    "datePublished": "2026-11-10T18:22:16.548Z",
    "dateReserved": "2026-11-05T21:53:37.806Z",
    "dateUpdated": "2026-11-13T18:11:01.366Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123381 (GCVE-0-2026-123381)

Vulnerability from cvelistv5 – Published: 2026-11-10 18:22 – Updated: 2026-11-13 18:10
VLAI
Title
Microsoft Office Outlook Remote Code Execution Vulnerability
Summary
Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 21:04 UTC
CWE
  • CWE-121 - Stack-based Buffer Overflow
  • CWE-681 - Incorrect Conversion between Numeric Types
Assigner
microsoft CNA under the mitre root
CNA scorecard B 82/100 over 4930 records in the last 180 days details
References
Impacted products
Vendor Product Version
Microsoft Microsoft 365 Apps for Enterprise Affected: 16.0.1 , < https://aka.ms/OfficeSecurityReleases (custom)
Create a notification for this product.
Microsoft Microsoft Office LTSC 2021 Affected: 16.0.1 , < 16.0.14334.21048 (custom)
Create a notification for this product.
Microsoft Microsoft Office LTSC 2024 Affected: 16.0.0 , < 16.0.17932.21140 (custom)
Create a notification for this product.
Date Public
2026-11-10 16:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-123381",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T21:04:24.526025Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T21:11:09.235Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "32-bit Systems",
            "x64-based Systems"
          ],
          "product": "Microsoft 365 Apps for Enterprise",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "https://aka.ms/OfficeSecurityReleases",
              "status": "affected",
              "version": "16.0.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "32-bit Systems",
            "x64-based Systems"
          ],
          "product": "Microsoft Office LTSC 2021",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "16.0.14334.21048",
              "status": "affected",
              "version": "16.0.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "32-bit Systems",
            "x64-based Systems"
          ],
          "product": "Microsoft Office LTSC 2024",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "16.0.17932.21140",
              "status": "affected",
              "version": "16.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:office_2021:*:*:*:*:long_term_servicing_channel:*:*:*",
                  "versionEndExcluding": "16.0.14334.21048",
                  "versionStartIncluding": "16.0.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:office_2024:*:*:*:*:long_term_servicing_channel:*:*:*",
                  "versionEndExcluding": "16.0.17932.21140",
                  "versionStartIncluding": "16.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*",
                  "versionEndExcluding": "https://aka.ms/OfficeSecurityReleases",
                  "versionStartIncluding": "16.0.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-11-10T16:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121: Stack-based Buffer Overflow",
              "lang": "en-US",
              "type": "CWE"
            },
            {
              "cweId": "CWE-681",
              "description": "CWE-681: Incorrect Conversion between Numeric Types",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T18:10:59.125Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Microsoft Office Outlook Remote Code Execution Vulnerability",
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-123381"
        }
      ],
      "title": "Microsoft Office Outlook Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2026-123381",
    "datePublished": "2026-11-10T18:22:14.495Z",
    "dateReserved": "2026-11-05T21:53:37.806Z",
    "dateUpdated": "2026-11-13T18:10:59.125Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123375 (GCVE-0-2026-123375)

Vulnerability from cvelistv5 – Published: 2026-11-10 18:22 – Updated: 2026-11-13 18:10
VLAI
Title
Microsoft Office Outlook Remote Code Execution Vulnerability
Summary
Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 21:05 UTC
CWE
  • CWE-121 - Stack-based Buffer Overflow
  • CWE-191 - Integer Underflow (Wrap or Wraparound)
Assigner
microsoft CNA under the mitre root
CNA scorecard B 82/100 over 4930 records in the last 180 days details
References
Impacted products
Vendor Product Version
Microsoft Microsoft 365 Apps for Enterprise Affected: 16.0.1 , < https://aka.ms/OfficeSecurityReleases (custom)
Create a notification for this product.
Microsoft Microsoft Office LTSC 2021 Affected: 16.0.1 , < 16.0.14334.21048 (custom)
Create a notification for this product.
Microsoft Microsoft Office LTSC 2024 Affected: 16.0.0 , < 16.0.17932.21140 (custom)
Create a notification for this product.
Date Public
2026-11-10 16:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-123375",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T21:05:36.685612Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T21:11:10.944Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "32-bit Systems",
            "x64-based Systems"
          ],
          "product": "Microsoft 365 Apps for Enterprise",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "https://aka.ms/OfficeSecurityReleases",
              "status": "affected",
              "version": "16.0.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "32-bit Systems",
            "x64-based Systems"
          ],
          "product": "Microsoft Office LTSC 2021",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "16.0.14334.21048",
              "status": "affected",
              "version": "16.0.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "32-bit Systems",
            "x64-based Systems"
          ],
          "product": "Microsoft Office LTSC 2024",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "16.0.17932.21140",
              "status": "affected",
              "version": "16.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:office_2021:*:*:*:*:long_term_servicing_channel:*:*:*",
                  "versionEndExcluding": "16.0.14334.21048",
                  "versionStartIncluding": "16.0.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:office_2024:*:*:*:*:long_term_servicing_channel:*:*:*",
                  "versionEndExcluding": "16.0.17932.21140",
                  "versionStartIncluding": "16.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*",
                  "versionEndExcluding": "https://aka.ms/OfficeSecurityReleases",
                  "versionStartIncluding": "16.0.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-11-10T16:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121: Stack-based Buffer Overflow",
              "lang": "en-US",
              "type": "CWE"
            },
            {
              "cweId": "CWE-191",
              "description": "CWE-191: Integer Underflow (Wrap or Wraparound)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T18:10:55.979Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Microsoft Office Outlook Remote Code Execution Vulnerability",
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-123375"
        }
      ],
      "title": "Microsoft Office Outlook Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2026-123375",
    "datePublished": "2026-11-10T18:22:11.212Z",
    "dateReserved": "2026-11-05T21:53:37.805Z",
    "dateUpdated": "2026-11-13T18:10:55.979Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}
Mitigation MIT-10
Operation Build and Compilation

Strategy: Environment Hardening

  • Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking.
  • D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
Mitigation
Architecture and Design

Use an abstraction library to abstract away risky APIs. Not a complete solution.

Mitigation
Implementation

Implement and perform bounds checking on input.

Mitigation
Implementation

Do not use dangerous functions such as gets. Use safer, equivalent functions which check for boundary errors.

Mitigation MIT-11
Operation Build and Compilation

Strategy: Environment Hardening

  • Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.
  • Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking.
  • For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].

No CAPEC attack patterns related to this CWE.

← Back to the CWE list