CWE-121: Stack-based Buffer Overflow vulnerabilities

SAP SAPSPrint Service has memory corruption vulnerabilities in the handling of certain commands. An unauthenticated attacker could send specially crafted requests that trigger a buffer overflow in the affected component. This causes a temporary service interruption and automatic restart, resulting in low impact on availability but no impact on confidentiality and integrity.

TBEA TLogger V2.1.0.0B0.0.0.0 contains multiple unauthenticated denial-of-service vulnerabilities in its web server. An unauthenticated remote attacker can invoke specific HTTP endpoints to reboot or reset the device, clear application data, or terminate the web server through a segmentation fault. In addition, multiple action endpoints process attacker-controlled parameters using unsafe string operations such as sprintf() and strcat() without adequate bounds checking, allowing crafted input to trigger buffer overflows and crash the web server. The affected endpoints include onRestart, onReset, ClearData, uploadInvFile, getIndiaRPData, YearCaparity, TotalfaultData, recordData, InvHistoryData, CollectHistoryData, InvFaultData, GetPortTableByParm, and UpdatePortConfig.

When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.

CVE-2026-21068 is a stack-based buffer overflow vulnerability in the libril_sem.so component of Samsung Mobile Devices prior to the SMR Aug-2026 Release 1. This flaw allows privileged local attackers to execute arbitrary code. The vulnerability has a high severity with a CVSS 4.0 score of 8.4. No specific affected versions or patch information is provided in the available data.

CVE-2026-18909 is a stack-based buffer overflow vulnerability in ELAN Microelectronics Corp.'s ELAN Smart-Pad driver on Windows, specifically in ETD.sys and ETDSMBus.sys. The flaw occurs during Intel SMBus recovery when ETDSMBus.sys fails to enforce an upper bound on a hardware-derived report count, allowing an out-of-range value to be used as a loop counter for a stack buffer copy in ETD.sys without size validation. A local attacker with standard user privileges can trigger a kernel crash (BSOD) causing denial of service. This affects versions up to and including 24.21.52.3. No patch or official remediation has been confirmed yet.

tinyobjloader-c's tinyobj_parse_and_index_mtl_file (tinyobj_loader_c.h) reads each line of a .mtl material file into a fixed 4096-byte stack buffer via memcpy(linebuf, p, p_len), guarded only by . The identical vulnerable pattern is duplicated in a second function in the same file.

microtar's mtar_write_file_header and mtar_write_dir_header functions (src/microtar.c) copy a caller-supplied entry name into the 100-byte field of a stack-allocated mtar_header_t via strcpy(h.name, name), with no check that strlen(name) is less than 100 before the copy.

** UNSUPPORTED WHEN ASSIGNED ** Stack-based Buffer Overflow vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. Lucy is now maintained outside of the ASF at https://github.com/lucysearch . This issue has been fixed in 0.8.0 there. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Keysight IxChariot Endpoint and associated products contain a stack-based buffer overflow. An unauthenticated remote attacker can send a specially crafted packet and execute arbitrary code with administrative privileges.

CVE-2026-25289 is a critical stack-based buffer overflow vulnerability in Qualcomm Snapdragon products. It occurs due to memory corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values. The flaw can lead to complete compromise of confidentiality, integrity, and availability without requiring user interaction.

CVE-2026-10710 is a high-severity stack-based buffer overflow vulnerability in Autodesk FBX SDK version 2020.3.9. It occurs in the function fbxsdk::ExtractDrive when parsing a maliciously crafted FBX file. Successful exploitation could allow an attacker to execute arbitrary code within the context of the affected process. The vulnerability requires local access with user interaction and has low attack complexity. No official patch or remediation guidance is currently provided by the vendor.

CVE-2026-10709 is a stack-based buffer overflow vulnerability in Autodesk FBX SDK version 2020.3.9. It occurs in the function fbxsdk::FbxIO::BinaryReadSectionHeader when parsing a maliciously crafted FBX file. Successful exploitation can allow arbitrary code execution within the context of the current process. The vulnerability has a high severity score of 7.8 and requires local access with user interaction to trigger.

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to buffer overflow in setgid helper db2flacc.

CVE-2026-7260 is a stack-based buffer overflow vulnerability in PHP caused by circular symbolic links in phar archives. This flaw can trigger unbounded recursion, exhausting the C stack and crashing the PHP process. It affects PHP versions prior to 8.2.33, 8.3.33, 8.4.24, and 8.5.9. The vulnerability has a medium severity rating with a CVSS score of 5.4. No official patch or remediation level is currently confirmed in the provided data.

A stack-based buffer overflow vulnerability was found in the File Explorer on the ADM. The vulnerability occurs because user-controlled input is not properly validated before being decoded and copied into a fixed-size stack buffer. An authenticated attacker can exploit this issue to cause denial of service of the affected CGI process. Further impact may be possible depending on exploitability and runtime protections. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RUN1 as well as from ADM 5.0.0 through ADM 5.1.3.RI81.

CVE-2026-13309 is a stack-based buffer overflow vulnerability in the Autel MaxiCharger AC Elite Home electric vehicle charger. It arises from improper handling of NFC card responses, allowing a crafted response to overflow a fixed-length stack buffer. This flaw enables an attacker with physical proximity to execute arbitrary code on the device without requiring authentication.

The TL-WR940N v6 router contains a vulnerability in its RTSP connection tracking module that can lead to a stack-based buffer overflow. The issue occurs when a LAN client initiates a connection to a malicious RTSP server controlled by an attacker. A specially crafted RTSP message may trigger improper memory handling within the kernel module Successful exploitation of this vulnerability may result in a denial-of-service (DoS) condition or allow remote code execution (RCE), potentially leading to full compromise of the device. This vulnerability can be exploited by an unauthenticated attacker under the device's default configuration.

The Apache Traffic Server uri_signing and url_sig plugins can exhaust the stack or crash on attacker input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

The Apache Traffic Server txn_box plugin overflows the stack from attacker-controlled input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

The Apache Traffic Server regex_remap plugin overflows the stack and integers from substitution input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.