CVE-2026-67673 describes a stack-based buffer overflow in OreSat Firmware v1.0's cmd_edl function. The vulnerability arises because the filename argument of the edl fw_flash command is copied into a 64-byte stack buffer using memcpy without proper length checks. This allows an attacker with physical access to the UART3 serial interface to send a maliciously crafted command with an oversized filename, triggering the overflow. The vulnerability is classified under CWE-121 (Stack-based Buffer Overflow).

The vulnerability can cause a denial of service (DoS) due to the stack-based buffer overflow. There is no indication of confidentiality or integrity impact. Exploitation requires physical access to the UART3 serial interface. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict physical access to the UART3 serial interface to trusted personnel only to prevent exploitation.