CWE-121: Stack-based Buffer Overflow vulnerabilities

CVE-2026-68878 is a stack-based buffer overflow vulnerability in the Windows Fast FAT Driver affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized attacker to elevate privileges over a network. The vulnerability has a high severity score and has been officially fixed in specific Windows 10 builds.

CVE-2026-62706 is an out-of-bounds read vulnerability in Microsoft Windows Media Foundation affecting multiple Windows 10 versions including Version 1607. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability has a high severity with a CVSS score of 8.8. Microsoft has released official fixes for all affected versions.

CVE-2026-9216 is a stack-based buffer overflow vulnerability in the NETGEAR RAX30 router management UI. It allows a network-adjacent attacker with network access, such as WiFi credentials, to crash the router's management interface. This vulnerability does not affect the confidentiality or integrity of the device or its core services like WiFi connectivity. The impact is limited to the management UI crashing, without causing a denial of service to the router's main functions.

CommServe contained a stack-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe.

CVE-2026-20509 is a stack-based buffer overflow vulnerability in the Power HAL component of MediaTek chipsets. The flaw arises from a missing bounds check, allowing an out-of-bounds write. Exploitation requires local access with System privileges but does not require user interaction. This vulnerability could lead to escalation of privileges and impacts confidentiality, integrity, and availability. A patch identified as ALPS11165543 addresses this issue.

A stack-based buffer overflow vulnerability exists in libxml2 versions before 2.15.4 in the xmlSnprintfElements function within valid.c. This flaw involves the use of strcat, which can lead to memory corruption. The vulnerability has a high severity with a CVSS score of 8.0 and impacts confidentiality, integrity, and availability.

A stack-based buffer overflow vulnerability exists in the PJLIB-UTIL telnet CLI front-end of the PJSIP pjproject library prior to commit 4472a31. This occurs when rendering feedback for an entered command line, where insufficient bounds checking allows a long command line to overflow fixed-size buffers. The vulnerability affects only applications that enable the telnet CLI front-end, which is an unauthenticated interactive administration interface. Exploitation requires access to this CLI, limiting impact beyond existing access. The issue has been patched in commit 4472a31.

A stack-based buffer overflow vulnerability (CWE-121) exists in the PJLIB-UTIL telnet CLI front-end of the pjsip pjproject prior to commit 628b716. The flaw occurs during command line redraw when recalling history entries, potentially causing application termination. Exploitation requires access to the unauthenticated telnet CLI, which already allows arbitrary CLI commands, limiting additional impact. Applications not enabling the telnet CLI front-end are unaffected. This issue has been patched.

A stack-based buffer overflow vulnerability exists in the GnuTLS TLS backend of the PJSIP pjproject library when parsing the Subject Alternative Name extension of a peer certificate. This affects only builds using GnuTLS (--with-gnutls). An attacker presenting a crafted certificate during the TLS handshake can trigger this overflow, potentially causing application crashes or memory corruption. The issue has been patched.

A stack-based buffer overflow vulnerability exists in the pjsip pjproject multimedia communication library in the SRTP/SDES media transport during SDP offer/answer processing. This occurs when handling an excessive number of a=crypto attributes in a single media description, leading to a write beyond a fixed-size stack array. The flaw is reachable from an incoming SIP INVITE before authentication and affects applications with SRTP enabled using SDES keying. The vulnerability has been patched.

A stack-based buffer overflow vulnerability exists in PJSIP's pjproject prior to commit acc03b5. The flaw occurs when processing Service-Route headers in a registration response, where an excessive number of headers can overflow a fixed-size stack array. This can lead to application crashes or memory corruption. The issue affects applications using the default registration path via the PJSUA/PJSUA2 account API. The vulnerability has been patched in commit acc03b5.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a stack-based buffer overflow.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to cause a denial of service due to a stack-based buffer overflow.

A stack-based buffer overflow vulnerability exists in the EasyMesh module of TP-Link Archer AX55 v4. When Mesh mode is enabled, a LAN attacker may submit crafted input that causes the easymesh daemon to crash and may potentially achieve remote code execution on the device. Successful exploitation may cause the EasyMesh daemon to crash and may potentially allow remote code execution when Mesh mode is enabled. This may result in high impact to the confidentiality, integrity, and availability of the affected device.

Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a stack buffer overflow vulnerability in file-level restore agent. A high privileged remote attacker could potentially exploit this vulnerability, leading to Information disclosure.

An issue in the NetStaX EtherNet/IP Stack prior to v5.6.1 could allow a large Class 3 explicit-message request to exceed the application-side receive buffer without generating an error or warning. The result could be memory corruption, a device crash, or a potential remote attack vector without the originating device receiving a CIP error indicating that the request could not be processed.

A denial-of-service security issue exists within FactoryTalk® Historian Machine Edition.  A network adjacent attacker who is authenticated could send crafted requests to the web interface, resulting in buffer overflow conditions that may cause the device to crash and become unresponsive.

NASA Trick version 19.6.0 contains a stack-based buffer overflow vulnerability in the JSONVariableServerThread::parse_request function within the TCP Socket Handler component. This flaw allows remote attackers to cause memory corruption by manipulating input data. The vendor has not provided a response or patch for this issue. The vulnerability has a CVSS score of 7.3, indicating a medium severity level.

A pre-authentication stack-based buffer overflow vulnerability exists in the http_gdpr_decrypt function of TL-MR100 V3.20 due to insufficient bounds checking of encrypted requests to the /cgi/login endpoint. An adjacent unauthenticated attacker with access to the router's web management interface can trigger memory corruption and potentially achieve arbitrary code execution. Successful exploitation can overwrite saved control-flow data on the httpd process stack prior to authentication, resulting in a service crash or potential arbitrary code execution in the context of the affected process.

CVE-2026-81533 is a medium severity stack-based buffer overflow vulnerability in the MongoDB BI Connector ODBC Driver. It occurs when a SQL statement includes a LIMIT clause followed by an unusually long sequence of digits, and the driver's optional prefetch setting is enabled. The vulnerability arises because the driver copies this digit sequence into a fixed-size buffer without validating its length. This can lead to application process termination or memory corruption if a user can control the numeric portion of the LIMIT clause.