CVE-2026-12661: CWE-121 Stack-based buffer overflow in Rockwell Automation FactoryTalk® Historian Machine Edition

This vulnerability (CVE-2026-12661) involves a stack-based buffer overflow (CWE-121) in the web interface of FactoryTalk® Historian Machine Edition by Rockwell Automation. An attacker with network adjacency and authentication privileges can send specially crafted requests that trigger buffer overflow conditions, leading to a denial-of-service by crashing the device. The CVSS 4.0 base score is 4.8 (medium), reflecting the attack vector as adjacent network with low attack complexity and no user interaction required. No official fix or patch has been confirmed as of the published date.

Successful exploitation causes denial-of-service by crashing the affected device, rendering it unresponsive. This impacts availability but does not indicate confidentiality or integrity compromise. The attacker must be authenticated and network adjacent, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the web interface to trusted users only and monitor for unusual activity. No official remediation or temporary fix is currently documented.