CVE-2026-71941 is a buffer overflow vulnerability in DrayTek VigorSwitch G2540xs caused by unsafe concatenation of multiple smtpReceiver email addresses into a fixed-size buffer in the diag_logmail function. The lack of bounds checking allows a remote attacker with administrative access to trigger the overflow, potentially causing denial of service or arbitrary code execution. The vulnerability requires valid admin credentials and does not involve user interaction. No official patch or remediation level has been published yet.

Successful exploitation can cause denial of service or potentially allow arbitrary command execution on the affected device. However, exploitation requires valid administrative credentials, limiting the attack surface to authorized users. There are no reports of known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted personnel only and monitor for suspicious activity involving the diag_logmail function or smtpReceiver email configurations.