CVE-2026-71979

Katalog CVE

CVSS 7.5 · High EPSS 0,58%

Kerentanan Stack-based Buffer Overflow. Skor CVSS 3.1 7.5 (High) menurut vulncheck.com.

Deskripsi (NVD)

INDI (Instrument Neutral Distributed Interface) indiserver through 2.2.4.2, fixed in commit 96bbd7f, contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to crash the daemon by sending malformed XML with mismatched tags whose names exceed 1024 bytes. Attackers can send a single TCP packet on port 7624 with mismatched XML tags to trigger an unbounded sprintf() write into a fixed 1024-byte stack buffer in MsgQueue.cpp, terminating the daemon and disrupting all active client and driver sessions.

Rincian

Terbit di NVD

17 Agustus 2026

Terakhir diubah

24 September 2026

Status NVD

Deferred

CVSS 3.1

7.5 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-121: Stack-based Buffer Overflow

EPSS (30 hari)

0,58% peluang dieksploitasi; lebih tinggi dari 46,4% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/indilib/indi/commit/96bbd7f564bbb128a129019e44eadd40dd49cff9
• https://github.com/indilib/indi/issues/2472
• https://www.vulncheck.com/advisories/indi-indiserver-stack-buffer-overflow-via-xml-tag-parsing