CWE-121: Stack-based Buffer Overflow vulnerabilities

bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data.

A vulnerability was found in Tenda HG7, HG9 and HG10 300001138_en_xpon. This affects the function formPPPEdit of the file /boaform/formPPPEdit. The manipulation of the argument encodename results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used.

A vulnerability was determined in Tenda HG7, HG9 and HG10 300001138_en_xpon. This affects the function formDOMAINBLK of the file /boaform/formDOMAINBLK. Executing a manipulation of the argument blkDomain can lead to stack-based buffer overflow. The attack may be performed from remote.

A vulnerability was found in Tenda HG7, HG9 and HG10 300001138_en_xpon. Affected by this issue is the function asp_voip_OtherSet of the file /boaform/voip_other_set of the component Web Management Interface. Performing a manipulation of the argument funckey_transfer results in stack-based buffer overflow. The attack is possible to be carried out remotely.

A stack-based buffer overflow vulnerability exists in Tapo C520WS v2 in the ONVIF DeleteUsers service, due to insufficient boundary checks when handling multiple user deletion parameters. An authenticated attacker can send a crafted malicious request containing an excessive number of identifiers to overflow stack memory. Successful exploitation may result in a service crash or deadlock, leading to DoS affecting device management and monitoring functionality.

A stack‑based buffer overflow vulnerability exists in Tapo C520WS v2 in the ONVIF CreateUsers service, where the device fails to properly validate the number of XML user nodes during request processing. An authenticated attacker can send a specially crafted ONVIF request containing an excessive number of user entries to trigger memory corruption. Successful exploitation may cause the ONVIF management service to terminate unexpectedly, resulting in a denial‑of‑service (DoS) condition that disrupts device configuration and management functions.

Stack-based buffer overflow vulnerability in Samsung Open Source rlottie allows Overflow Buffers. This issue affects rlottie: before ce72b35a7ad0dded03051d3aa0ef75321c3bd035.

A remote attacker with user privileges can exploit a stack buffer overflow in gdv-serverconfig to gain full system access as root.

A remote attacker with user privileges can exploit a stack buffer overflow in dali-devconfig to gain full system access as root.

A remote attacker with user privileges can exploit a stack buffer overflow to gain full system access as root.

CZ.NIC BIRD Internet Routing Daemon through 2.19.0 contains a stack-based buffer overflow in the BGP AS_PATH mask matching implementation in nest/a-path.c. The as_path_match() function uses a fixed-size stack array of 2048 + 1 pm_pos entries, while parse_path() expands AS_PATH segments from a received BGP UPDATE without enforcing a corresponding capacity limit. When RFC 8654 BGP Extended Messages are enabled and a BIRD filter evaluates an AS path mask expression such as "bgp_path ~ [= ... =]", an established BGP peer can send a long AS_PATH containing more than 2048 expanded ASNs. This causes parse_path()/as_path_match() to write beyond the fixed stack buffer, resulting in a crash of the daemon. NOTE: reportedly, the Supplier's position is that a fix is not being prioritized because all network operators should already be rejecting routes with unusually long attributes.

TP-Link Tapo C200 v5 contains a stack-based buffer overflow flaw in RTSP authentication handling due to improper validation of Authorization header field lengths, which can be triggered by a crafted authentication request. Successful exploitation causes the affected RTSP core service process to crash and triggers an automatic system reboot, resulting in a denial of service (DoS) condition. This prevents legitimate users from accessing the camera’s live video stream or management interface until the service restarts.

CVE-2026-24085 is a high-severity stack-based buffer overflow vulnerability in Qualcomm Snapdragon devices caused by improper initialization of a variable when processing display command line information. This memory corruption issue can lead to complete compromise of confidentiality, integrity, and availability. No patch or official remediation guidance is currently available from the vendor. The vulnerability requires privileged access and does not involve user interaction. There are no known exploits in the wild at this time.

CVE-2025-59613 is a stack-based buffer overflow vulnerability in Qualcomm Snapdragon products. It occurs due to memory corruption when the output buffer size is smaller than the input buffer size during a data copying operation. The vulnerability affects multiple Qualcomm Snapdragon platforms and related components. The CVSS score is 6.7, indicating a medium severity level. No official patch or remediation information is currently available from the vendor. There are no known exploits in the wild at this time.

CVE-2025-59612 is a stack-based buffer overflow vulnerability (CWE-121) in Qualcomm Snapdragon products caused by memory corruption in Windows drivers when processing incorrect trusted application requests. It affects multiple Qualcomm Snapdragon platforms and related components. The vulnerability has a CVSS score of 6.7, indicating a medium severity level. There is no information about available patches or official remediation at this time. No known exploits in the wild have been reported.

In certain scenarios when the admin has enabled Interactive Connectivity Establishment (ICE), a buffer overflow could enable remote code execution on Poly Voice products on the Linux platform.

CVE-2026-9038 is a high-severity stack-based buffer overflow vulnerability in the XCharge C6 charging controller. It arises from insufficient validation of message fields supplied via the charging interface, which can lead to memory corruption. An attacker with physical access to the charging interface can exploit this flaw to execute unauthorized code with elevated privileges. There is no confirmed patch or official remediation available at this time. The vulnerability has not been reported as exploited in the wild.

CryptX versions prior to 0.088_001 for Perl contain a stack-based buffer overflow vulnerability in four AEAD decrypt_verify helper functions. These functions copy an attacker-controlled authentication tag into a fixed 144-byte stack buffer without validating the tag length, allowing an overflow if the tag is longer. The issue affects gcm_decrypt_verify, ccm_decrypt_verify, chacha20poly1305_decrypt_verify, and eax_decrypt_verify XS routines. Version 0.088 introduced a clamp to gcm_decrypt_verify, and 0.088_001 added clamps to the other three functions to prevent this overflow. No official patch or remediation guidance is currently documented in the vendor advisory or patch links.

CVE-2026-8362 is a critical stack-based buffer overflow vulnerability in Gladinet Triofox. It occurs in the WOSDefaultHttpModule.dll component when processing a long URL path starting with /woshome. The vulnerability has a CVSS 3.1 score of 9.8, indicating high impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available. There are no known exploits in the wild at this time.

CVE-2026-8363 is a critical stack-based buffer overflow vulnerability in Gladinet Triofox, specifically in the WOSDeviceDropFolder.dll component when processing a long URL path starting with /resources:. The vulnerability has a CVSS score of 9.8, indicating high severity with potential for complete confidentiality, integrity, and availability compromise. No patch or official remediation guidance is currently available, and no known exploits in the wild have been reported. Users should monitor vendor advisories for updates.