CVE-2026-56766 is a stack buffer overflow vulnerability in the vanhauser-thc thc-hydra tool affecting versions up to and including 9.7. The flaw occurs in NTLM authentication modules across SMTP, POP3, IMAP, NNTP, HTTP, HTTP-Proxy, and HTTP-Proxy-Urlenum when a malicious server sends a crafted NTLM Type-2 challenge containing an excessively long domain string. This causes the base64-encoded response data to overflow a 500-byte stack buffer by 18 to 330 bytes, potentially enabling remote code execution on systems without stack protection. The vulnerability is fixed in a commit identified as 9cc84c2, which is after version 9.7.

Successful exploitation allows a remote attacker controlling a malicious server to cause a stack buffer overflow in the client processing NTLM authentication, potentially leading to remote code execution on vulnerable systems that lack stack protection. This affects multiple protocol modules within thc-hydra, increasing the attack surface.

A fix is available in the commit identified as 9cc84c2, which resolves the vulnerability after version 9.7. Users should upgrade to a version that includes this fix. Since no official patch version is explicitly stated, users should monitor the vendor's repository or advisories for the fixed release. Systems with stack protection may mitigate exploitation risk, but upgrading is recommended.