This vulnerability is a stack-based buffer overflow (CWE-121) affecting HP Inc.'s poly_trio_8300 Poly Voice products on Linux platforms. It arises under certain conditions when the Interactive Connectivity Establishment (ICE) feature is enabled by an administrator. The flaw could be exploited remotely to execute arbitrary code, potentially compromising the affected device. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The vulnerability was published on June 1, 2026, with no vendor-provided patch or remediation level specified.

Successful exploitation of this vulnerability could lead to remote code execution on affected Poly Voice devices running Linux, potentially allowing an attacker to fully compromise the device. The critical CVSS score of 9.2 reflects the high severity and ease of exploitation without privileges or user interaction. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider disabling Interactive Connectivity Establishment (ICE) if feasible, as the vulnerability occurs only when ICE is enabled. Monitor HP Inc. advisories for updates and apply patches promptly once available.