CVE-2026-19386: CWE-121: Stack-based Buffer Overflow in ASUS Router

This vulnerability involves a stack-based buffer overflow (CWE-121) in ASUS router modules. An authenticated user within network proximity can trigger arbitrary code execution by uploading a configuration file crafted to exceed buffer size limits. The vulnerability is rated critical with a CVSS 4.0 score of 9.3, reflecting high impact on confidentiality, integrity, and availability. The vendor advisory referenced suggests a security update exists but no explicit patch or affected versions are detailed in the provided data.

Successful exploitation allows an authenticated nearby attacker to execute arbitrary code on the affected ASUS router, potentially compromising device control and network security. The vulnerability impacts confidentiality, integrity, and availability of the device and connected networks. No known active exploitation has been reported.

Patch status is not yet confirmed — check the ASUS Security Advisory for current remediation guidance. Since the vulnerability requires authentication and proximity, limiting access to the router's management interface and monitoring for unusual configuration uploads may reduce risk until an official fix is applied.