This vulnerability involves improper restriction of operations within the bounds of a memory buffer (CWE-119) in the multipart form-data parser implemented in jst_post.c of RDK-B WebUI. The flaw allows a remote attacker without authentication to trigger a heap-based buffer overflow by crafting a malicious multipart/form-data HTTP request. Successful exploitation can lead to memory corruption, denial of service, and possibly arbitrary code execution on the affected system. The affected product version is identified as rdkb-2025q4-kirkstone.04.10.26. No CVSS score or vendor remediation information is currently available.

Exploitation of this vulnerability can result in memory corruption and denial of service, disrupting the availability of the RDK-B WebUI service. Additionally, it may allow an attacker to execute arbitrary code remotely without authentication, posing a significant security risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit exposure of the RDK-B WebUI to untrusted networks and monitor for suspicious multipart/form-data requests. Avoid deploying this version in sensitive environments without additional protective controls.