CVE-2026-12221: Stack-based Buffer Overflow in Yealink SIP-T46U
A vulnerability was found in Yealink SIP-T46U 108.86.0.118. This impacts the function sprintf of the file /api/upgrade/upgrade of the component Firmware Chunk Upload Handler. Performing a manipulation of the argument uid/start_offset results in stack-based buffer overflow. The attack needs to be approached within the local network. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
AI Analysis
Technical Summary
This vulnerability affects Yealink SIP-T46U firmware version 108.86.0.118. It is a stack-based buffer overflow triggered by improper handling of the uid/start_offset arguments in the sprintf function of the /api/upgrade/upgrade endpoint, part of the Firmware Chunk Upload Handler. The flaw allows an attacker with local network access to cause a buffer overflow, potentially leading to code execution or denial of service. The vendor was notified but has not issued a fix or advisory. The vulnerability is rated high severity with a CVSS 4.0 score of 8.6.
Potential Impact
Successful exploitation can lead to a stack-based buffer overflow, which may allow an attacker on the local network to execute arbitrary code or cause a denial of service on the affected device. The vulnerability impacts the firmware upgrade handling process, potentially compromising device integrity and availability.
Mitigation Recommendations
No official patch or remediation is currently available from the vendor. Since the vulnerability requires local network access, restricting access to the device's management interfaces and limiting local network exposure can reduce risk. Monitor for any future vendor advisories or firmware updates addressing this issue.
CVE-2026-12221: Stack-based Buffer Overflow in Yealink SIP-T46U
Description
A vulnerability was found in Yealink SIP-T46U 108.86.0.118. This impacts the function sprintf of the file /api/upgrade/upgrade of the component Firmware Chunk Upload Handler. Performing a manipulation of the argument uid/start_offset results in stack-based buffer overflow. The attack needs to be approached within the local network. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0
Score 8.6high
Affected software
cpe:2.3:a:yealink:sip-t46u:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects Yealink SIP-T46U firmware version 108.86.0.118. It is a stack-based buffer overflow triggered by improper handling of the uid/start_offset arguments in the sprintf function of the /api/upgrade/upgrade endpoint, part of the Firmware Chunk Upload Handler. The flaw allows an attacker with local network access to cause a buffer overflow, potentially leading to code execution or denial of service. The vendor was notified but has not issued a fix or advisory. The vulnerability is rated high severity with a CVSS 4.0 score of 8.6.
Potential Impact
Successful exploitation can lead to a stack-based buffer overflow, which may allow an attacker on the local network to execute arbitrary code or cause a denial of service on the affected device. The vulnerability impacts the firmware upgrade handling process, potentially compromising device integrity and availability.
Mitigation Recommendations
No official patch or remediation is currently available from the vendor. Since the vulnerability requires local network access, restricting access to the device's management interfaces and limiting local network exposure can reduce risk. Monitor for any future vendor advisories or firmware updates addressing this issue.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-06-14T13:54:18.805Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a2f96421cccde5f260cd689
Added to database: 6/15/2026, 6:05:54 AM
Last enriched: 6/15/2026, 6:20:43 AM
Last updated: 6/15/2026, 9:48:39 AM
Views: 14
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.