CVE-2026-1949 is a critical vulnerability in the Delta Electronics AS320T web service caused by incorrect calculation of buffer size on the stack within the GET/PUT request handler. This buffer size miscalculation (CWE-131) can lead to memory corruption, potentially allowing an attacker to execute arbitrary code or cause denial of service. The vulnerability is remotely exploitable without privileges or user interaction, as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:N). The product is cloud-hosted, and remediation is managed by the vendor with a patch available.

Successful exploitation of this vulnerability could result in complete compromise of confidentiality, integrity, and availability of the affected system. Given the critical CVSS score of 9.8 and the nature of the flaw, attackers could execute arbitrary code remotely or cause service disruption. No known exploits are currently reported in the wild.

A patch is available for this vulnerability. Since the product is a cloud service, the vendor manages remediation server-side. Users should verify with the vendor advisory that their service instance is updated to the patched version to mitigate this vulnerability. No additional mitigation steps are indicated by the vendor at this time.