CVE-2026-77532: CWE-122 Heap-based buffer overflow in Ubiquiti Inc EdgeMAX EdgeSwitch

This vulnerability (CVE-2026-77532) is a heap-based buffer overflow (CWE-122) in Ubiquiti EdgeMAX EdgeSwitch devices with DHCPv6 enabled. It allows a remote attacker on an adjacent network to trigger remote code execution by exploiting the buffer overflow condition. The CVSS 3.1 base score is 9.6, reflecting low attack complexity, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed but lacks an official fix or patch as of the publication date. The vendor has not provided remediation details, and no exploits have been reported in the wild.

Successful exploitation results in remote code execution on the EdgeMAX EdgeSwitch device, compromising confidentiality, integrity, and availability. This could allow an attacker to fully control the device, potentially disrupting network operations or using the device as a foothold for further attacks. The attack requires network adjacency but no authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, network administrators should consider disabling DHCPv6 on affected devices if feasible or isolate the device from untrusted adjacent networks to reduce exposure.