CVE-2026-18585 is a medium severity heap-based buffer overflow vulnerability affecting the nas-web.get_file_list function in the APPS-NAS Module of various GL.iNet devices up to the 20260707 firmware version. The flaw allows remote attackers with low privileges to cause a heap overflow by manipulating the function input, potentially leading to memory corruption. The vendor was notified and confirmed the issue, but no patch or official fix has been disclosed as of the publication date.

Successful exploitation could lead to memory corruption on affected devices, potentially causing crashes or enabling further attacks depending on the device's configuration and usage. The vulnerability is remotely exploitable without user interaction and requires low privileges, increasing the risk of remote compromise or denial of service. However, no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the affected nas-web.get_file_list function and monitor for unusual activity. Follow vendor communications for updates on patches or mitigations.