CVE-2026-96676 describes a stack-based buffer overflow vulnerability in the get_alias_name function of the uhttpd component within Fast FAC1900R version 20190827_2.0.2. The vulnerability allows remote attackers to cause memory corruption potentially leading to denial of service or limited information disclosure. Exploit code is publicly available. The vendor was contacted but has not issued any response or patch.

Successful exploitation may lead to partial confidentiality, integrity, and availability impacts as indicated by the CVSS vector (C:L/I:L/A:L). The vulnerability can be triggered remotely without user interaction but requires low privileges (PR:L). No confirmed active exploitation in the wild is reported.

No official fix or patch is currently available from the vendor. Since the vendor has not responded, users should consider mitigating exposure by restricting remote access to the affected component if possible. Monitor for updates from the vendor or security advisories for any future patches.