CWE-121: Stack-based Buffer Overflow vulnerabilities

CVE-2026-39457 is a stack-based buffer overflow vulnerability in FreeBSD's libnv library. It occurs because libnv uses select(2) to wait for data on a socket without verifying that the socket descriptor is within the FD_SETSIZE limit (1024). An attacker who can cause an application using libnv to allocate large file descriptors may trigger stack corruption. If the vulnerable application is setuid-root, this flaw could be exploited for local privilege escalation.

AMR-NB codec crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service

BEEP protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service

ZigBee protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service

HTTP protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service

A post-authentication Stack-based Buffer Overflow vulnerabilities in SonicOS allows a remote attacker to crash a firewall.

CVE-2026-7035 is a high-severity stack-based buffer overflow vulnerability in Tenda FH1202 version 1.2.0.14. It affects the httpd component, specifically the fromWrlclientSet function in the /goform/WrlclientSet file. An attacker can remotely exploit this by manipulating the Go argument, potentially causing a buffer overflow. The vulnerability has been publicly disclosed, but no official patch or remediation has been indicated yet.

CVE-2026-7034 is a high-severity stack-based buffer overflow vulnerability in the Tenda FH1202 router firmware version 1.2.0.14(408). The flaw exists in the WrlExtraSet function of the httpd component, where manipulation of the Go argument can trigger the overflow. This vulnerability can be exploited remotely without user interaction or privileges. Although an exploit has been publicly disclosed, there are no known exploits in the wild at this time. No official patch or remediation guidance has been provided by the vendor yet.

arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, there is a remotely reachable memory corruption issue in the NBNS packet handling path. When NetBIOS is enabled by calling NBNS.begin(...), the device listens on UDP port 137 and processes untrusted NBNS requests from the local network. The request parser trusts the attacker-controlled name_len field without enforcing a bound consistent with the fixed-size destination buffers used later in the flow. This vulnerability is fixed in 3.3.8.

CVE-2026-1951 is a critical stack-based buffer overflow vulnerability in the Delta Electronics AS320T device. The issue arises because the product does not properly check the length of a buffer associated with directory names, leading to potential memory corruption. This vulnerability has a CVSS score of 9.8, indicating high severity with network attack vector, no privileges required, and impacts on confidentiality, integrity, and availability. The affected product is a cloud service, and a patch is available. There are no known exploits in the wild at this time.

Delta Electronics AS320T device contains a stack-based buffer overflow vulnerability due to lack of length checking on a buffer related to file names. This vulnerability has a critical CVSS score of 9.8, indicating it can be exploited remotely without privileges or user interaction, leading to full confidentiality, integrity, and availability compromise. The affected product is a cloud service, and a patch is available. There are no known exploits in the wild at this time.

Dell PowerProtect Data Domain running Domain Operating System versions 7.7.1.0 through 8.6, and certain LTS2024 and LTS2025 releases, contains a stack-based buffer overflow vulnerability. This flaw allows an unauthenticated remote attacker to potentially execute arbitrary commands on the affected system. The vulnerability is identified as CVE-2026-26354 with a high severity rating and a CVSS score of 8.1. No official patch or remediation guidance has been provided yet by Dell. There are no known exploits in the wild at this time.

PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, a stack buffer overflow exists in pjsip_auth_create_digest2() in PJSIP when using pre-computed digest credentials (PJSIP_CRED_DATA_DIGEST). The function copies credential data using cred_info->data.slen as the length without an upper-bound check, which can overflow the fixed-size ha1 stack buffer (128 bytes) if data.slen exceeds the expected digest string length.

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain a stack-based buffer overflow vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.

A stack-based buffer overflow vulnerability was found in the VPN Clients on the ADM. The issue stems from the use of unbounded sscanf() and passing user-controlled data directly to printf(). Due to the lack of PIE and Stack Canary protections, an authenticated remote attacker can exploit these to execute arbitrary code as the web server user. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RR42 as well as from ADM 5.0.0 through ADM 5.1.2.REO1.

editorconfig-core-c is an EditorConfig core library for use by plugins supporting EditorConfig parsing. Versions up to and including 0.12.10 have a stack-based buffer overflow in ec_glob() that allows an attacker to crash any application using libeditorconfig by providing a specially crafted directory structure and .editorconfig file. This is an incomplete fix for CVE-2023-0341. The pcre_str buffer was protected in 0.12.6 but the adjacent l_pattern[8194] stack buffer received no equivalent protection. On Ubuntu 24.04, FORTIFY_SOURCE converts the overflow to SIGABRT (DoS). Version 0.12.11 contains an updated fix.

MailGates/MailAudit developed by Openfind has a Stack-based Buffer Overflow vulnerability, allowing unauthenticated remote attackers to control the program's execution flow and execute arbitrary code.

Certain HP DeskJet All in One devices may be vulnerable to remote code execution caused by a buffer overflow when specially crafted Web Services for Devices (WSD) scan requests are improperly validated and handled by the MFP. WSD Scan is a Microsoft Windows–based network scanning protocol that allows a PC to discover scanners (and MFPs) on a network and send scan jobs to them without requiring vendor specific drivers or utilities.

Stack-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to deny service over a network.

Stack-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.