CVE-2026-18271

Kenwood DNR1007XR vCardParser Heap-based Buffer Overflow Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DNR1007XR devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the vCardParser class. The issue results from the lack of proper validation of a user-supplied string before copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-28974.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector : AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 0.9 / Impact : 5.9

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.kenwood.com/cs/ce/mm/firmware/2020/2020f/eng.html
https://www.zerodayinitiative.com/advisories/ZDI-26-488/

Configurations

No configuration.

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de ejecución de código por desbordamiento de búfer basado en montículo en el vCardParser de Kenwood DNR1007XR. Esta vulnerabilidad permite a atacantes presentes físicamente ejecutar código arbitrario en instalaciones afectadas de dispositivos Kenwood DNR1007XR. La autenticación no es requerida para explotar esta vulnerabilidad. La falla específica existe dentro de la clase vCardParser. El problema resulta de la falta de validación adecuada de una cadena proporcionada por el usuario antes de copiarla a un búfer basado en montículo. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto de root. Fue ZDI-CAN-28974.

Information

Published : 2026-08-20 17:17

Updated : 2026-10-18 20:10

NVD link : CVE-2026-18271

Mitre link : CVE-2026-18271

CVE.ORG link : CVE-2026-18271

JSON object : View

Products Affected

No product.

CWE

CWE-122

Heap-based Buffer Overflow

{"id": "CVE-2026-18271", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18271", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-26T19:41:17.285470Z"}}], "cvssMetricV30": [{"type": "Secondary", "source": "zdi-disclosures@trendmicro.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.8, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.9}]}, "affected": [{"source": "zdi-disclosures@trendmicro.com", "affectedData": [{"vendor": "Kenwood", "product": "DNR1007XR", "versions": [{"status": "affected", "version": "1.7.0003.1000"}], "defaultStatus": "unknown"}]}], "published": "2026-08-20T17:17:23.640", "references": [{"url": "https://www.kenwood.com/cs/ce/mm/firmware/2020/2020f/eng.html", "source": "zdi-disclosures@trendmicro.com"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-488/", "source": "zdi-disclosures@trendmicro.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "zdi-disclosures@trendmicro.com", "description": [{"lang": "en", "value": "CWE-122"}]}], "descriptions": [{"lang": "en", "value": "Kenwood DNR1007XR vCardParser Heap-based Buffer Overflow Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DNR1007XR devices. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the vCardParser class. The issue results from the lack of proper validation of a user-supplied string before copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-28974."}, {"lang": "es", "value": "Vulnerabilidad de ejecuci\u00f3n de c\u00f3digo por desbordamiento de b\u00fafer basado en mont\u00edculo en el vCardParser de Kenwood DNR1007XR. Esta vulnerabilidad permite a atacantes presentes f\u00edsicamente ejecutar c\u00f3digo arbitrario en instalaciones afectadas de dispositivos Kenwood DNR1007XR. La autenticaci\u00f3n no es requerida para explotar esta vulnerabilidad.\n\nLa falla espec\u00edfica existe dentro de la clase vCardParser. El problema resulta de la falta de validaci\u00f3n adecuada de una cadena proporcionada por el usuario antes de copiarla a un b\u00fafer basado en mont\u00edculo. Un atacante puede aprovechar esta vulnerabilidad para ejecutar c\u00f3digo en el contexto de root. Fue ZDI-CAN-28974."}], "lastModified": "2026-10-18T20:10:00.110", "sourceIdentifier": "zdi-disclosures@trendmicro.com"}