CVE-2026-71979: Stack-based Buffer Overflow in indilib indi
INDI (Instrument Neutral Distributed Interface) indiserver through 2.2.4.2, fixed in commit 96bbd7f, contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to crash the daemon by sending malformed XML with mismatched tags whose names exceed 1024 bytes. Attackers can send a single TCP packet on port 7624 with mismatched XML tags to trigger an unbounded sprintf() write into a fixed 1024-byte stack buffer in MsgQueue.cpp, terminating the daemon and disrupting all active client and driver sessions.
AI Analysis
Technical Summary
The INDI (Instrument Neutral Distributed Interface) indiserver through version 2.2.4.2 has a stack buffer overflow vulnerability in MsgQueue.cpp. An attacker can send a single TCP packet on port 7624 containing malformed XML with mismatched tags whose names exceed 1024 bytes. This triggers an unbounded sprintf() write into a fixed 1024-byte stack buffer, leading to a crash of the daemon process. The vulnerability does not require authentication and results in denial of service by terminating the indiserver and disrupting all active sessions. The issue was fixed in commit 96bbd7f, but no official patch or advisory is currently linked.
Potential Impact
Successful exploitation causes the indiserver daemon to crash, resulting in denial of service and disruption of all active client and driver sessions. There is no indication of code execution or data corruption beyond service termination. The vulnerability can be triggered remotely without authentication by sending a specially crafted TCP packet to port 7624.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability was fixed in commit 96bbd7f, so upgrading to a version including this commit or later is recommended once available. Until then, restricting network access to port 7624 or filtering malformed XML traffic may reduce exposure.
CVE-2026-71979: Stack-based Buffer Overflow in indilib indi
Description
INDI (Instrument Neutral Distributed Interface) indiserver through 2.2.4.2, fixed in commit 96bbd7f, contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to crash the daemon by sending malformed XML with mismatched tags whose names exceed 1024 bytes. Attackers can send a single TCP packet on port 7624 with mismatched XML tags to trigger an unbounded sprintf() write into a fixed 1024-byte stack buffer in MsgQueue.cpp, terminating the daemon and disrupting all active client and driver sessions.
CVSS v4.0
Score 8.7high
Affected software
indilib
indi
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The INDI (Instrument Neutral Distributed Interface) indiserver through version 2.2.4.2 has a stack buffer overflow vulnerability in MsgQueue.cpp. An attacker can send a single TCP packet on port 7624 containing malformed XML with mismatched tags whose names exceed 1024 bytes. This triggers an unbounded sprintf() write into a fixed 1024-byte stack buffer, leading to a crash of the daemon process. The vulnerability does not require authentication and results in denial of service by terminating the indiserver and disrupting all active sessions. The issue was fixed in commit 96bbd7f, but no official patch or advisory is currently linked.
Potential Impact
Successful exploitation causes the indiserver daemon to crash, resulting in denial of service and disruption of all active client and driver sessions. There is no indication of code execution or data corruption beyond service termination. The vulnerability can be triggered remotely without authentication by sending a specially crafted TCP packet to port 7624.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability was fixed in commit 96bbd7f, so upgrading to a version including this commit or later is recommended once available. Until then, restricting network access to port 7624 or filtering malformed XML traffic may reduce exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-08T16:43:04.178Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a834becbf8831d5394ecf99
Added to database: 08/17/2026, 17:59:08 UTC
Last enriched: 08/17/2026, 18:11:08 UTC
Last updated: 10/02/2026, 02:46:06 UTC
Views: 72
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.