CVE-2026-12221: Stack-based Buffer Overflow in Yealink SIP-T46U
A vulnerability was found in Yealink SIP-T46U 108.86.0.118. This impacts the function sprintf of the file /api/upgrade/upgrade of the component Firmware Chunk Upload Handler. Performing a manipulation of the argument uid/start_offset results in stack-based buffer overflow. The attack needs to be approached within the local network. The exploit has been made public and could be used. The vendor was contacted early about this disclosure and is working on a patch to fix it.
AI Analysis
Technical Summary
This vulnerability affects Yealink SIP-T46U firmware version 108.86.0.118. It is caused by improper handling of the uid/start_offset arguments in the sprintf function of the /api/upgrade/upgrade endpoint, leading to a stack-based buffer overflow. Exploitation requires an attacker to be on the local network and involves sending crafted requests to trigger the overflow. The vendor has been informed and is developing a fix, but no official patch is currently available. The CVSS 4.0 score is 8.6, indicating high severity with local attack vector, low attack complexity, no privileges required beyond local access, and no user interaction needed.
Potential Impact
Successful exploitation of this vulnerability can lead to a stack-based buffer overflow, potentially allowing an attacker to execute arbitrary code or cause a denial of service on the affected device. Because the attack requires local network access, remote exploitation is not feasible without prior network access. The vulnerability affects the firmware upgrade handling process, which is critical for device integrity.
Mitigation Recommendations
No official patch or fix is currently available. The vendor is working on a patch to address this issue. Until a patch is released, restrict access to the device's local network to trusted users only and monitor for any suspicious activity related to firmware upgrade endpoints. Avoid exposing the device to untrusted local networks. Check the vendor advisory regularly for updates on patch availability.
CVE-2026-12221: Stack-based Buffer Overflow in Yealink SIP-T46U
Description
A vulnerability was found in Yealink SIP-T46U 108.86.0.118. This impacts the function sprintf of the file /api/upgrade/upgrade of the component Firmware Chunk Upload Handler. Performing a manipulation of the argument uid/start_offset results in stack-based buffer overflow. The attack needs to be approached within the local network. The exploit has been made public and could be used. The vendor was contacted early about this disclosure and is working on a patch to fix it.
CVSS v4.0
Score 8.6high
Affected software
cpe:2.3:a:yealink:sip-t46u:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects Yealink SIP-T46U firmware version 108.86.0.118. It is caused by improper handling of the uid/start_offset arguments in the sprintf function of the /api/upgrade/upgrade endpoint, leading to a stack-based buffer overflow. Exploitation requires an attacker to be on the local network and involves sending crafted requests to trigger the overflow. The vendor has been informed and is developing a fix, but no official patch is currently available. The CVSS 4.0 score is 8.6, indicating high severity with local attack vector, low attack complexity, no privileges required beyond local access, and no user interaction needed.
Potential Impact
Successful exploitation of this vulnerability can lead to a stack-based buffer overflow, potentially allowing an attacker to execute arbitrary code or cause a denial of service on the affected device. Because the attack requires local network access, remote exploitation is not feasible without prior network access. The vulnerability affects the firmware upgrade handling process, which is critical for device integrity.
Mitigation Recommendations
No official patch or fix is currently available. The vendor is working on a patch to address this issue. Until a patch is released, restrict access to the device's local network to trusted users only and monitor for any suspicious activity related to firmware upgrade endpoints. Avoid exposing the device to untrusted local networks. Check the vendor advisory regularly for updates on patch availability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-06-14T13:54:18.805Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a2f96421cccde5f260cd689
Added to database: 06/15/2026, 06:05:54 UTC
Last enriched: 06/27/2026, 20:58:28 UTC
Last updated: 07/31/2026, 19:22:57 UTC
Views: 463
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.