CVE-2026-19508: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer in RDK RDK-B WebUI

This vulnerability (CVE-2026-19508) involves improper restriction of operations within the bounds of a memory buffer (CWE-119) in the multipart form-data parser implemented in jst_post.c of the RDK-B WebUI. The heap-based buffer overflow can be triggered remotely without authentication via a specially crafted multipart/form-data HTTP request. Successful exploitation can lead to memory corruption, denial of service, and potentially arbitrary code execution. The CVSS v3.1 base score is 9.8, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

An unauthenticated remote attacker can exploit this vulnerability to cause memory corruption and denial of service on the affected RDK-B WebUI component. Additionally, there is potential for arbitrary code execution, which could lead to full system compromise. The high CVSS score reflects the critical nature and ease of exploitation over the network without any privileges.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the affected RDK-B WebUI service to trusted networks or applying network-level protections to block malicious multipart/form-data requests.