CVE-2026-76870 is an out-of-bounds read vulnerability affecting Netcore NR255-V version 1.5.130703. The issue occurs in the mtd_write pre-flash validation routine when a short (truncated) firmware upload is performed via put_file_cgi.c. This triggers out-of-bounds reads across main.c, check_image_uuid.c, and oemMD5Update.c. The vulnerability has a CVSS 4.0 base score of 7.1, reflecting a high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. There is no indication of known exploits in the wild or available patches.

Successful exploitation allows an attacker with low privileges to cause out-of-bounds reads by uploading a truncated firmware image. This could lead to information disclosure or application instability. The vulnerability does not require user interaction and can be triggered remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, restrict access to the firmware upload interface and monitor for suspicious truncated firmware upload attempts.