Common Weakness Enumeration

CWE-121

Allowed

Stack-based Buffer Overflow

Abstraction: Variant · Status: Draft

API response cwe.mitre.org

A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

5203 vulnerabilities reference this CWE, most recent first.

CVE-2026-30983 (GCVE-0-2026-30983)

Vulnerability from cvelistv5 – Published: 2026-03-10 17:52 – Updated: 2026-03-10 19:32
VLAI
Title
iccDEV has a stack buffer overflow in icFixXml()
Summary
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a stack buffer overflow in icFixXml() (strcpy) causing stack memory corruption or crash. This vulnerability is fixed in 2.3.1.5.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
  • CWE-121 - Stack-based Buffer Overflow
  • CWE-787 - Out-of-bounds Write
Assigner
References
Impacted products
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-30983",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-10T19:20:55.752359Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-10T19:32:27.497Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "iccDEV",
          "vendor": "InternationalColorConsortium",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.3.1.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a stack buffer overflow in icFixXml() (strcpy) causing stack memory corruption or crash. This vulnerability is fixed in 2.3.1.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-120",
              "description": "CWE-120: Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121: Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787: Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-10T17:52:28.593Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-h3ph-mwq5-3883",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-h3ph-mwq5-3883"
        },
        {
          "name": "https://github.com/InternationalColorConsortium/iccDEV/issues/624",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InternationalColorConsortium/iccDEV/issues/624"
        },
        {
          "name": "https://github.com/InternationalColorConsortium/iccDEV/pull/634",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InternationalColorConsortium/iccDEV/pull/634"
        },
        {
          "name": "https://github.com/InternationalColorConsortium/iccDEV/releases/tag/v2.3.1.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InternationalColorConsortium/iccDEV/releases/tag/v2.3.1.5"
        }
      ],
      "source": {
        "advisory": "GHSA-h3ph-mwq5-3883",
        "discovery": "UNKNOWN"
      },
      "title": "iccDEV has a stack buffer overflow in icFixXml()"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-30983",
    "datePublished": "2026-03-10T17:52:28.593Z",
    "dateReserved": "2026-03-07T17:53:48.817Z",
    "dateUpdated": "2026-03-10T19:32:27.497Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-30980 (GCVE-0-2026-30980)

Vulnerability from cvelistv5 – Published: 2026-03-10 18:07 – Updated: 2026-03-10 19:32
VLAI
Title
iccDEV has a stack overflow in CIccBasicStructFactory::CreateStruct()
Summary
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a stack overflow in CIccBasicStructFactory::CreateStruct() causing uncontrolled recursion/stack exhaustion and crash. This vulnerability is fixed in 2.3.1.5.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-121 - Stack-based Buffer Overflow
  • CWE-400 - Uncontrolled Resource Consumption
  • CWE-674 - Uncontrolled Recursion
Assigner
References
Impacted products
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-30980",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-10T19:26:00.547956Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-10T19:32:25.781Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "iccDEV",
          "vendor": "InternationalColorConsortium",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.3.1.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a stack overflow in CIccBasicStructFactory::CreateStruct() causing uncontrolled recursion/stack exhaustion and crash. This vulnerability is fixed in 2.3.1.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121: Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-10T18:07:26.404Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-w478-77q7-2hc2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-w478-77q7-2hc2"
        },
        {
          "name": "https://github.com/InternationalColorConsortium/iccDEV/issues/629",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InternationalColorConsortium/iccDEV/issues/629"
        },
        {
          "name": "https://github.com/InternationalColorConsortium/iccDEV/pull/630",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InternationalColorConsortium/iccDEV/pull/630"
        },
        {
          "name": "https://github.com/InternationalColorConsortium/iccDEV/releases/tag/v2.3.1.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InternationalColorConsortium/iccDEV/releases/tag/v2.3.1.5"
        }
      ],
      "source": {
        "advisory": "GHSA-w478-77q7-2hc2",
        "discovery": "UNKNOWN"
      },
      "title": "iccDEV has a stack overflow in CIccBasicStructFactory::CreateStruct()"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-30980",
    "datePublished": "2026-03-10T18:07:26.404Z",
    "dateReserved": "2026-03-07T17:53:48.817Z",
    "dateUpdated": "2026-03-10T19:32:25.781Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-30929 (GCVE-0-2026-30929)

Vulnerability from cvelistv5 – Published: 2026-03-09 21:46 – Updated: 2026-03-10 14:52
VLAI
Title
ImageMagick has a stack buffer overflow in MagnifyImage
Summary
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, MagnifyImage uses a fixed-size stack buffer. When using a specific image it is possible to overflow this buffer and corrupt the stack. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.
Severity
7.7 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
ImageMagick ImageMagick Affected: >= 7.0.0, < 7.1.2-16
Affected: < 6.9.13-41
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-30929",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-10T14:52:35.286679Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-10T14:52:41.954Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ImageMagick",
          "vendor": "ImageMagick",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 7.0.0, \u003c 7.1.2-16"
            },
            {
              "status": "affected",
              "version": "\u003c 6.9.13-41"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, MagnifyImage uses a fixed-size stack buffer. When using a specific image it is possible to overflow this buffer and corrupt the stack. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121: Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787: Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-09T21:46:31.861Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rqq8-jh93-f4vg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rqq8-jh93-f4vg"
        }
      ],
      "source": {
        "advisory": "GHSA-rqq8-jh93-f4vg",
        "discovery": "UNKNOWN"
      },
      "title": "ImageMagick has a stack buffer overflow in MagnifyImage"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-30929",
    "datePublished": "2026-03-09T21:46:31.861Z",
    "dateReserved": "2026-03-07T16:40:05.885Z",
    "dateUpdated": "2026-03-10T14:52:41.954Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-30897 (GCVE-0-2026-30897)

Vulnerability from cvelistv5 – Published: 2026-03-10 16:44 – Updated: 2026-03-11 03:56
VLAI
Summary
A stack-based buffer overflow vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow a remote authenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands via crafted HTTP requests.
Severity
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • CWE-121 - Execute unauthorized code or commands
Assigner
References
Impacted products
Vendor Product Version
Fortinet FortiWeb Affected: 8.0.0 , ≤ 8.0.3 (semver)
Affected: 7.6.0 , ≤ 7.6.6 (semver)
Affected: 7.4.0 , ≤ 7.4.11 (semver)
Affected: 7.2.0 , ≤ 7.2.12 (semver)
Affected: 7.0.0 , ≤ 7.0.12 (semver)
    cpe:2.3:a:fortinet:fortiweb:8.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:8.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:8.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:8.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.6.6:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.6.5:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.6.4:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.6.3:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.6.2:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.6.1:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.6.0:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.4.11:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.4.10:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.4.9:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.4.8:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.4.7:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.4.6:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.4.5:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.4.4:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.4.3:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.4.2:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.4.1:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.4.0:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.2.12:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.2.11:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.2.10:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.2.9:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.2.8:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.2.7:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.2.6:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.2.5:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.2.4:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.2.3:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.2.0:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.0.12:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.0.11:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.0.10:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.0.9:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.0.8:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.0.7:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.0.6:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiweb:7.0.0:*:*:*:*:*:*:*
 Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-30897",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-10T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-11T03:56:47.990Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:fortinet:fortiweb:8.0.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:8.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:8.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:8.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.6.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.6.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.6.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.6.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.6.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.6.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.6.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.11:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.10:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.2.12:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.2.11:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.2.10:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.2.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.2.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.2.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.2.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.2.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.2.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.2.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.2.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.2.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.2.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.0.12:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.0.11:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.0.10:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.0.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.0.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.0.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.0.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.0.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.0.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.0.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.0.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiWeb",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "8.0.3",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.6.6",
              "status": "affected",
              "version": "7.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.4.11",
              "status": "affected",
              "version": "7.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.12",
              "status": "affected",
              "version": "7.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.12",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A stack-based buffer overflow vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow a remote authenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands via crafted HTTP requests."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "Execute unauthorized code or commands",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-10T16:44:04.857Z",
        "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
        "shortName": "fortinet"
      },
      "references": [
        {
          "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-093",
          "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-093"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to FortiWeb version 8.0.4 or above\nUpgrade to FortiWeb version 7.6.7 or above\nUpgrade to FortiWeb version 7.4.12 or above"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
    "assignerShortName": "fortinet",
    "cveId": "CVE-2026-30897",
    "datePublished": "2026-03-10T16:44:04.857Z",
    "dateReserved": "2026-03-06T12:49:20.922Z",
    "dateUpdated": "2026-03-11T03:56:47.990Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-30872 (GCVE-0-2026-30872)

Vulnerability from cvelistv5 – Published: 2026-03-19 21:56 – Updated: 2026-03-25 03:56
VLAI
Title
OpenWrt Project has a Stack-based Buffer Overflow vulnerability via IPv6 reverse DNS lookup
Summary
OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6 and 25.12.1, the mdns daemon has a Stack-based Buffer Overflow vulnerability in the match_ipv6_addresses function, triggered when processing PTR queries for IPv6 reverse DNS domains (.ip6.arpa) received via multicast DNS on UDP port 5353. During processing, the domain name from name_buffer is copied via strcpy into a fixed 256-byte stack buffer, and then the reverse IPv6 request is extracted into a buffer of only 46 bytes (INET6_ADDRSTRLEN). Because the length of the data is never validated before this extraction, an attacker can supply input larger than 46 bytes, causing an out-of-bounds write. This allows a specially crafted DNS query to overflow the stack buffer in match_ipv6_addresses, potentially enabling remote code execution. This issue has been fixed in versions 24.10.6 and 25.12.1.
Severity
9.5 (Critical)
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SSVC
Exploitation: none Automatable: yes Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • CWE-121 - Stack-based Buffer Overflow
Assigner
References
Impacted products
Vendor Product Version
openwrt openwrt Affected: >= 25.12.0-rc1, < 25.12.1
Affected: < 24.10.6
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-30872",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-24T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-25T03:56:13.660Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "openwrt",
          "vendor": "openwrt",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 25.12.0-rc1, \u003c 25.12.1"
            },
            {
              "status": "affected",
              "version": "\u003c 24.10.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6 and 25.12.1, the mdns daemon has a Stack-based Buffer Overflow vulnerability in the match_ipv6_addresses function, triggered when processing PTR queries for IPv6 reverse DNS domains (.ip6.arpa) received via multicast DNS on UDP port 5353. During processing, the domain name from name_buffer is copied via strcpy into a fixed 256-byte stack buffer, and then the reverse IPv6 request is extracted into a buffer of only 46 bytes (INET6_ADDRSTRLEN). Because the length of the data is never validated before this extraction, an attacker can supply input larger than 46 bytes, causing an out-of-bounds write. This allows a specially crafted DNS query to overflow the stack buffer in match_ipv6_addresses, potentially enabling remote code execution. This issue has been fixed in versions 24.10.6 and 25.12.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.5,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121: Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-19T21:56:23.472Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/openwrt/openwrt/security/advisories/GHSA-mpgh-v658-jqv5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/openwrt/openwrt/security/advisories/GHSA-mpgh-v658-jqv5"
        },
        {
          "name": "https://github.com/openwrt/openwrt/releases/tag/v24.10.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openwrt/openwrt/releases/tag/v24.10.6"
        },
        {
          "name": "https://github.com/openwrt/openwrt/releases/tag/v25.12.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openwrt/openwrt/releases/tag/v25.12.1"
        }
      ],
      "source": {
        "advisory": "GHSA-mpgh-v658-jqv5",
        "discovery": "UNKNOWN"
      },
      "title": "OpenWrt Project has a Stack-based Buffer Overflow vulnerability via IPv6 reverse DNS lookup"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-30872",
    "datePublished": "2026-03-19T21:56:23.472Z",
    "dateReserved": "2026-03-06T00:04:56.698Z",
    "dateUpdated": "2026-03-25T03:56:13.660Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-30871 (GCVE-0-2026-30871)

Vulnerability from cvelistv5 – Published: 2026-03-19 21:49 – Updated: 2026-03-25 03:56
VLAI
Title
OpenWrt Project has Stack-based Buffer Overflow in DNS PTR Query
Summary
OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6 and 25.12.1, the mdns daemon has a Stack-based Buffer Overflow vulnerability in the parse_question function. The issue is triggered by PTR queries for reverse DNS domains (.in-addr.arpa and .ip6.arpa). DNS packets received on UDP port 5353 are expanded by dn_expand into an 8096-byte global buffer (name_buffer), which is then copied via an unbounded strcpy into a fixed 256-byte stack buffer when handling TYPE_PTR queries. The overflow is possible because dn_expand converts non-printable ASCII bytes (e.g., 0x01) into multi-character octal representations (e.g., \001), significantly inflating the expanded name beyond the stack buffer's capacity. A crafted DNS packet can exploit this expansion behavior to overflow the stack buffer, making the vulnerability reachable through normal multicast DNS packet processing. This issue has been fixed in versions 24.10.6 and 25.12.1.
Severity
9.5 (Critical)
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SSVC
Exploitation: none Automatable: yes Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • CWE-121 - Stack-based Buffer Overflow
Assigner
References
Impacted products
Vendor Product Version
openwrt openwrt Affected: < 24.10.6
Affected: >= 25.12.0-rc1, < 25.12.1
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-30871",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-24T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-25T03:56:12.627Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "openwrt",
          "vendor": "openwrt",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 24.10.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 25.12.0-rc1, \u003c 25.12.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6 and 25.12.1, the mdns daemon has a Stack-based Buffer Overflow vulnerability in the parse_question function. The issue is  triggered by PTR queries for reverse DNS domains (.in-addr.arpa and .ip6.arpa). DNS packets received on UDP port 5353 are expanded by dn_expand into an 8096-byte global buffer (name_buffer), which is then copied via an unbounded strcpy into a fixed 256-byte stack buffer when handling TYPE_PTR queries. The overflow is possible because dn_expand converts non-printable ASCII bytes (e.g., 0x01) into multi-character octal representations (e.g., \\001), significantly inflating the expanded name beyond the stack buffer\u0027s capacity. A crafted DNS packet can exploit this expansion behavior to overflow the stack buffer, making the vulnerability reachable through normal multicast DNS packet processing. This issue has been fixed in versions 24.10.6 and 25.12.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.5,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121: Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-19T21:49:50.876Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/openwrt/openwrt/security/advisories/GHSA-7c3j-f7w2-p8f6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/openwrt/openwrt/security/advisories/GHSA-7c3j-f7w2-p8f6"
        },
        {
          "name": "https://github.com/openwrt/openwrt/releases/tag/v24.10.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openwrt/openwrt/releases/tag/v24.10.6"
        },
        {
          "name": "https://github.com/openwrt/openwrt/releases/tag/v25.12.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openwrt/openwrt/releases/tag/v25.12.1"
        }
      ],
      "source": {
        "advisory": "GHSA-7c3j-f7w2-p8f6",
        "discovery": "UNKNOWN"
      },
      "title": "OpenWrt Project has Stack-based Buffer Overflow in DNS PTR Query"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-30871",
    "datePublished": "2026-03-19T21:49:50.876Z",
    "dateReserved": "2026-03-06T00:04:56.698Z",
    "dateUpdated": "2026-03-25T03:56:12.627Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-30814 (GCVE-0-2026-30814)

Vulnerability from cvelistv5 – Published: 2026-04-08 17:52 – Updated: 2026-05-07 15:47
VLAI
Title
Buffer Overflow Vulnerability in TP-Link AX53
Summary
A stack-based buffer overflow in the tmpServer module of TP-Link Archer AX53 v1.0 allows an authenticated adjacent attacker to trigger a segmentation fault and potentially execute arbitrary code via a specially crafted configuration file. Successful exploitation may cause a crash and could allow arbitrary code execution, enabling modification of device state, exposure of sensitive data, or further compromise of device integrity. This issue affects AX53 v1.0: before 1.7.1 Build 20260213.
Severity
7.3 (High)
CVSS:4.0/AV:A/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • CWE-121 - Stack-based buffer overflow
Assigner
References
Impacted products
Vendor Product Version
TP-Link Systems Inc. AX53 v1.0 Affected: 0 , < 1.7.1 Build 20260213 (custom)
Create a notification for this product.
Credits
Lilith >_> of Cisco Talos
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-30814",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-08T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-09T03:56:15.034Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-05-07T15:47:00.488Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2302"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "tmpServer"
          ],
          "product": "AX53 v1.0",
          "vendor": "TP-Link Systems Inc.",
          "versions": [
            {
              "lessThan": "1.7.1 Build 20260213",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Lilith \u003e_\u003e of Cisco Talos"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A stack-based buffer overflow in the tmpServer module of TP-Link Archer AX53 v1.0\u0026nbsp;allows an authenticated adjacent attacker to trigger a segmentation fault and potentially execute arbitrary code via a specially crafted configuration file. Successful exploitation may cause a crash and could allow arbitrary code execution, enabling modification of device state, exposure of sensitive data, or further compromise of device integrity.\n\u003cbr\u003e\u003cp\u003eThis issue affects AX53 v1.0: before 1.7.1 Build 20260213.\u003c/p\u003e"
            }
          ],
          "value": "A stack-based buffer overflow in the tmpServer module of TP-Link Archer AX53 v1.0\u00a0allows an authenticated adjacent attacker to trigger a segmentation fault and potentially execute arbitrary code via a specially crafted configuration file. Successful exploitation may cause a crash and could allow arbitrary code execution, enabling modification of device state, exposure of sensitive data, or further compromise of device integrity.\n\nThis issue affects AX53 v1.0: before 1.7.1 Build 20260213."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-100",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-100 Overflow Buffers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121 Stack-based buffer overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:52:00.929Z",
        "orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
        "shortName": "TPLink"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/my/support/download/archer-ax53/v1/#Firmware"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/en/support/download/archer-ax53/v1/#Firmware"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://talosintelligence.com/vulnerability_reports/"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.tp-link.com/us/support/faq/5055/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Buffer Overflow Vulnerability in TP-Link AX53",
      "x_generator": {
        "engine": "Vulnogram 1.0.0-beta"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
    "assignerShortName": "TPLink",
    "cveId": "CVE-2026-30814",
    "datePublished": "2026-04-08T17:52:00.929Z",
    "dateReserved": "2026-03-05T17:35:52.174Z",
    "dateUpdated": "2026-05-07T15:47:00.488Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-29068 (GCVE-0-2026-29068)

Vulnerability from cvelistv5 – Published: 2026-03-06 06:36 – Updated: 2026-03-09 19:51
VLAI
Title
PJSIP: Stack buffer overflow in Opus codec parser
Summary
PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, there is a stack buffer overflow vulnerability when pjmedia-codec parses an RTP payload contain more frames than the caller-provided frames can hold. This issue has been patched in version 2.17.
Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-121 - Stack-based Buffer Overflow
Assigner
References
Impacted products
Vendor Product Version
pjsip pjproject Affected: < 2.17
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-29068",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-09T19:51:11.998135Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-09T19:51:25.167Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pjproject",
          "vendor": "pjsip",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.17"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, there is a stack buffer overflow vulnerability when pjmedia-codec parses an RTP payload contain more frames than the caller-provided frames can hold. This issue has been patched in version 2.17."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121: Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-06T06:36:45.790Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pjsip/pjproject/security/advisories/GHSA-pqww-jrxr-457f",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pjsip/pjproject/security/advisories/GHSA-pqww-jrxr-457f"
        },
        {
          "name": "https://github.com/pjsip/pjproject/commit/6c9024511bf5307ff72efde1f90c9a2a226d8967",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pjsip/pjproject/commit/6c9024511bf5307ff72efde1f90c9a2a226d8967"
        }
      ],
      "source": {
        "advisory": "GHSA-pqww-jrxr-457f",
        "discovery": "UNKNOWN"
      },
      "title": "PJSIP: Stack buffer overflow in Opus codec parser"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-29068",
    "datePublished": "2026-03-06T06:36:45.790Z",
    "dateReserved": "2026-03-03T20:51:43.482Z",
    "dateUpdated": "2026-03-09T19:51:25.167Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-28690 (GCVE-0-2026-28690)

Vulnerability from cvelistv5 – Published: 2026-03-09 21:39 – Updated: 2026-03-10 15:58
VLAI
Title
ImageMagick has a stack write buffer overflow in MNG encoder
Summary
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a stack buffer overflow vulnerability exists in the MNG encoder. There is a bounds checks missing that could corrupting the stack with attacker-controlled data. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.
Severity
6.9 (Medium)
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-121 - Stack-based Buffer Overflow
Assigner
References
Impacted products
Vendor Product Version
ImageMagick ImageMagick Affected: >= 7.0.0, < 7.1.2-16
Affected: < 6.9.13-41
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-28690",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-10T15:58:08.780047Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-10T15:58:15.300Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ImageMagick",
          "vendor": "ImageMagick",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 7.0.0, \u003c 7.1.2-16"
            },
            {
              "status": "affected",
              "version": "\u003c 6.9.13-41"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a stack buffer overflow vulnerability exists in the MNG encoder. There is a bounds checks missing that could corrupting the stack with attacker-controlled data. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121: Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-09T21:39:53.647Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7h7q-j33q-hvpf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7h7q-j33q-hvpf"
        }
      ],
      "source": {
        "advisory": "GHSA-7h7q-j33q-hvpf",
        "discovery": "UNKNOWN"
      },
      "title": "ImageMagick has a stack write buffer overflow in MNG encoder"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-28690",
    "datePublished": "2026-03-09T21:39:53.647Z",
    "dateReserved": "2026-03-02T21:43:19.927Z",
    "dateUpdated": "2026-03-10T15:58:15.300Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-28494 (GCVE-0-2026-28494)

Vulnerability from cvelistv5 – Published: 2026-03-09 21:31 – Updated: 2026-03-10 14:41
VLAI
Title
ImageMagick affected by stack corruption through long morphology kernel names or arrays
Summary
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a stack buffer overflow exists in ImageMagick's morphology kernel parsing functions. User-controlled kernel strings exceeding a buffer are copied into fixed-size stack buffers via memcpy without bounds checking, resulting in stack corruption. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • CWE-121 - Stack-based Buffer Overflow
Assigner
References
Impacted products
Vendor Product Version
ImageMagick ImageMagick Affected: >= 7.0.0, < 7.1.2-16
Affected: < 6.9.13-41
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-28494",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-10T14:40:59.673356Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-10T14:41:51.357Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ImageMagick",
          "vendor": "ImageMagick",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 7.0.0, \u003c 7.1.2-16"
            },
            {
              "status": "affected",
              "version": "\u003c 6.9.13-41"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a stack buffer overflow exists in ImageMagick\u0027s morphology kernel parsing functions. User-controlled kernel strings exceeding a buffer are copied into fixed-size stack buffers via memcpy without bounds checking, resulting in stack corruption. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121: Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-09T21:31:36.139Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-932h-jw47-73jm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-932h-jw47-73jm"
        }
      ],
      "source": {
        "advisory": "GHSA-932h-jw47-73jm",
        "discovery": "UNKNOWN"
      },
      "title": "ImageMagick affected by stack corruption through long morphology kernel names or arrays"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-28494",
    "datePublished": "2026-03-09T21:31:36.139Z",
    "dateReserved": "2026-02-27T20:57:47.708Z",
    "dateUpdated": "2026-03-10T14:41:51.357Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}
Mitigation MIT-10
Operation Build and Compilation

Strategy: Environment Hardening

  • Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking.
  • D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
Mitigation
Architecture and Design

Use an abstraction library to abstract away risky APIs. Not a complete solution.

Mitigation
Implementation

Implement and perform bounds checking on input.

Mitigation
Implementation

Do not use dangerous functions such as gets. Use safer, equivalent functions which check for boundary errors.

Mitigation MIT-11
Operation Build and Compilation

Strategy: Environment Hardening

  • Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.
  • Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking.
  • For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].

No CAPEC attack patterns related to this CWE.

← Back to the CWE list