CVE-2026-94582: CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in Brocade Fabric OS

This vulnerability involves a classic buffer overflow (CWE-120) in the internal diagnostic and route validation routines of the FSPF protocol in Brocade Fabric OS versions prior to 10.0.1. The flaw allows incoming or internally routed diagnostic payloads to exceed allocated memory boundaries, leading to heap or stack memory overruns. Exploitation requires chaining with other vulnerabilities since the affected code is not directly reachable through normal management interfaces. Successful exploitation could cause a routing daemon crash (denial of service) or enable arbitrary code execution within the daemon's context.

An attacker who can leverage other vulnerabilities to reach the internal diagnostic routines may trigger a heap- or stack-based buffer overflow. This can result in a denial of service by crashing the routing daemon or potentially allow arbitrary code execution within the daemon's context. The vulnerability does not appear directly exploitable via standard user interfaces or CLI commands.

No explicit patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerable code is not directly accessible via standard interfaces, mitigating exposure to other vulnerabilities that could be chained is recommended until an official fix is available.