A stack-based buffer overflow vulnerability exists in the diagnostic execution utility of Brocade Fabric OS versions before 10.0.1. When processing command arguments for diagnostic operations, the utility tokenizes user-supplied input into an internal argument array without enforcing boundary checks on the maximum array capacity. An authenticated user with administrative access can exploit this vulnerability by supplying a crafted diagnostic command string containing an excessive number of tokenized arguments. This leads to a memory overwrite resulting in a denial of service (process crash).
A stack-based buffer overflow vulnerability exists in the Internet Key Exchange (IKEv2) protocol handler on Brocade Fabric OS versions before 10.0.1. The vulnerability occurs when processing initial IKE key exchange requests on extension switches or blades running IPsec-enabled Fibre Channel over IP (FCIP) circuits. An unauthenticated remote attacker can exploit this vulnerability by sending a single, specifically crafted UDP packet (Port 500) containing an oversized Nonce payload. Successful exploitation results in a denial of service (data-plane process crash)
A stack-based buffer overflow vulnerability exists in the security library component of Brocade Fabric OS versions before 10.0.1. When parsing uploaded X.509 PEM certificates for management display, the system improperly validates the length of the Authority Key Identifier (AKI) extension before copying string tokens into an internal memory buffer. An authenticated user with administrative privileges to import custom certificates can supply a certificate containing an intentionally oversized AKI extension. When the system processes or renders the certificate attributes, this can trigger a stack memory corruption leading to a denial-of-service (DoS) condition by crashing the management daemon.
A stack-based buffer overflow vulnerability exists in the SNMP daemon request handling of Brocade Fabric versions before 10.0.1. When processing an incoming SNMPv3 packet, an internal statistics gathering handler copies user-supplied context name data into a fixed-size buffer without properly validating the length of the string. A remote, unauthenticated attacker (under default configuration) can exploit this vulnerability by sending a specially crafted SNMPv3 packet, leading to memory corruption, daemon crash (Denial of Service), or potential arbitrary code execution.
Multiple stack-based buffer overflow vulnerabilities exist in the REST API management component of Brocade Fabric OS versions prior to 10.0.1. When processing API request payloads (such as device configuration attributes or port mapping requests) the REST API service fails to properly validate incoming array counts and string lengths against internal buffer capacities. An authenticated attacker with REST API access can transmit crafted, oversized request parameters to induce memory corruption on the execution stack. This may result in a denial-of-service condition (daemon crash) or potential arbitrary code execution within the management process context.
VMware Workstation and Fusion contain a stack-based buffer-overflow vulnerability in HGFS. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.
Affected versions:
- VMware Workstation: 25H2, 26H1 (fixed in 26H1u1)
- VMware Fusion: 25H2, 26H1 (fixed in 26H1u1)
Unsigned integer underflow in wstrncat() in src/port.c in wolfSSL wolfSSH from v1.4.11 through v1.5.0 on non-Windows platforms allows an authenticated remote attacker to write one out-of-bounds null byte past the end of a stack buffer by sending a crafted SFTP path. wolfSSH_RealPath() in src/ssh.c appends each path component with a remaining-size bound (outSz - curSz) rather than the full destination size, so once the accumulated path reaches half the output buffer the size_t computation n - strlen(s1) - 1 wraps to near SIZE_MAX. The strncat() call is then effectively unbounded and copies the whole component; when that component exactly fills the remainder of the buffer, its terminating null is written one byte past the end. The caller's own length check keeps the copied data inside the buffer, so the overflow is limited to that single null byte, which may corrupt an adjacent stack value and crash the process. Applications that call the public wolfSSH_RealPath() with an output buffer smaller than the input path are additionally exposed to an unbounded copy, because the word32 expression outSz - segSz in that length check also wraps.
CVE-2026-19386 is a critical stack-based buffer overflow vulnerability in ASUS router modules. It allows an authenticated nearby user to execute arbitrary code by uploading a crafted configuration file that exceeds the expected buffer size. The vulnerability requires high privileges and no user interaction. No specific affected versions or patch information is provided in the available data.
CVE-2026-102165 is a stack-based buffer overflow vulnerability in Arista Networks Wi-Fi Access Points. An unauthenticated attacker with network access to the capture service can send a specially crafted packet to cause the service to crash or potentially execute remote code. Exploitation requires use of a non-default streaming mode that is uncommonly enabled. The vulnerability affects multiple versions of the product up to 22.0.1F-32. The CVSS score is 7.5, indicating high severity.
CVE-2026-102167 is a stack-based buffer overflow vulnerability in Arista Networks Wi-Fi Access Points affecting certain firmware versions. It allows an unauthenticated attacker on the same network segment as the wired uplink to cause memory corruption that can crash the sensor service or potentially enable remote code execution. The vulnerability has a high severity with a CVSS score of 7.5. No explicit patch or remediation details are provided in the available data.
A stack-based buffer overflow vulnerability exists in Arista Networks Wi-Fi Access Points when captive portal or application firewall is enabled on at least one SSID. An unauthenticated network-adjacent attacker can send a crafted packet to the wireless gateway service, triggering a stack overflow that may cause denial-of-service or arbitrary code execution. The wireless gateway service restarts automatically after a crash, enabling repeated exploitation attempts.
TP-Link Tapo
C500 v2.0 contains an out-of-bounds stack write vulnerability in its ONVIF PTZ
SOAP handlers. An authenticated ONVIF client can submit an excessive number of
preset-related elements, causing writes beyond the bounds of fixed-size stack
arrays and resulting in a crash of the affected service.
Successful
exploitation may allow an authenticated attacker to cause the affected service
to crash, resulting in a denial-of-service condition. Repeated exploitation may
repeatedly disrupt camera management and PTZ-related functionality until the
service recovers or restarts.
CVE-2026-20521 is a high-severity stack-based buffer overflow vulnerability in MediaTek chipsets affecting multiple specific models. The flaw exists in the Video HAL component due to a missing bounds check, allowing local escalation of privilege without requiring user interaction or additional execution privileges. This vulnerability could lead to full compromise of confidentiality, integrity, and availability on affected devices.
CVE-2026-66837 is a high-severity stack-based buffer overflow and integer overflow vulnerability in the PHP bindings of Apache Thrift. It affects all versions prior to 0.25.0. The issue allows for potential memory corruption due to improper handling of buffer sizes. Apache has released version 0.25.0 to address this vulnerability.
CVE-2026-93925 is a high-severity stack-based buffer overflow vulnerability in the Apache Thrift C++ THeaderProtocol caused by an incorrect bitwise shift of an integer. This flaw affects Apache Thrift versions before 0.25.0. The issue has been fixed in version 0.25.0, and users are advised to upgrade to this version to mitigate the risk.
CVE-2026-86325 is a critical stack-based buffer overflow vulnerability in the account management interface of Moxa MGate MB3170 Series protocol gateways. It arises from insufficient validation of the length of the 'account_name' parameter during account management requests. An authenticated read-only user can exploit this by supplying an overly long account name, leading to corruption of program execution flow. Exploitation can result in unauthorized reading of sensitive device memory, including credentials, arbitrary memory modification, and disruption of device availability.
CVE-2026-103552 is a stack-based buffer overflow vulnerability in the Apache Directory LDAP API. The flaw occurs when a client sends a deeply nested search filter before binding, causing the server's decoder to overflow the stack. This affects versions from 1.2.0 up to but not including 1.2.9. The issue is fixed in version 1.2.9. The vulnerability has a high severity with a CVSS score of 7.3.
A stack-based buffer overflow vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Deco M9 Plus due to insufficient validation of decrypted request data length before it is copied into a fixed-size stack buffer in the subtype 0x91 handler. Successful exploitation may allow an adjacent, unauthenticated attacker to cause a denial of service or achieve arbitrary code execution during the device setup phase through crafted TDDP packets.