CVE-2026-71979

INDI (Instrument Neutral Distributed Interface) indiserver through 2.2.4.2, fixed in commit 96bbd7f, contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to crash the daemon by sending malformed XML with mismatched tags whose names exceed 1024 bytes. Attackers can send a single TCP packet on port 7624 with mismatched XML tags to trigger an unbounded sprintf() write into a fixed 1024-byte stack buffer in MsgQueue.cpp, terminating the daemon and disrupting all active client and driver sessions.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/indilib/indi/commit/96bbd7f564bbb128a129019e44eadd40dd49cff9
https://github.com/indilib/indi/issues/2472
https://www.vulncheck.com/advisories/indi-indiserver-stack-buffer-overflow-via-xml-tag-parsing
https://github.com/indilib/indi/issues/2472

Configurations

No configuration.

History

23 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) INDI (Instrument Neutral Distributed Interface) indiserver hasta 2.2.4.2, corregido en el commit 96bbd7f, contiene una vulnerabilidad de desbordamiento de búfer de pila que permite a atacantes remotos no autenticados bloquear el demonio enviando XML malformado con etiquetas no coincidentes cuyos nombres exceden los 1024 bytes. Los atacantes pueden enviar un único paquete TCP en el puerto 7624 con etiquetas XML no coincidentes para activar una escritura sprintf() sin límites en un búfer de pila fijo de 1024 bytes en MsgQueue.cpp, terminando el demonio e interrumpiendo todas las sesiones activas de cliente y controlador.

Information

Published : 2026-08-17 18:18

Updated : 2026-10-23 16:10

NVD link : CVE-2026-71979

Mitre link : CVE-2026-71979

CVE.ORG link : CVE-2026-71979

JSON object : View

Products Affected

No product.

CWE

CWE-121

Stack-based Buffer Overflow

{"id": "CVE-2026-71979", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71979", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-17T19:34:04.492826Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/indilib/indi", "vendor": "indilib", "product": "indi", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2.2.4.2"}, {"status": "unaffected", "version": "96bbd7f564bbb128a129019e44eadd40dd49cff9", "versionType": "git"}], "packageURL": "pkg:github/indilib/indi", "defaultStatus": "affected"}]}], "published": "2026-08-17T18:18:12.370", "references": [{"url": "https://github.com/indilib/indi/commit/96bbd7f564bbb128a129019e44eadd40dd49cff9", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/indilib/indi/issues/2472", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/indi-indiserver-stack-buffer-overflow-via-xml-tag-parsing", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/indilib/indi/issues/2472", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-121"}]}], "descriptions": [{"lang": "en", "value": "INDI (Instrument Neutral Distributed Interface) indiserver through 2.2.4.2, fixed in commit 96bbd7f, contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to crash the daemon by sending malformed XML with mismatched tags whose names exceed 1024 bytes. Attackers can send a single TCP packet on port 7624 with mismatched XML tags to trigger an unbounded sprintf() write into a fixed 1024-byte stack buffer in MsgQueue.cpp, terminating the daemon and disrupting all active client and driver sessions."}, {"lang": "es", "value": "INDI (Instrument Neutral Distributed Interface) indiserver hasta 2.2.4.2, corregido en el commit 96bbd7f, contiene una vulnerabilidad de desbordamiento de b\u00fafer de pila que permite a atacantes remotos no autenticados bloquear el demonio enviando XML malformado con etiquetas no coincidentes cuyos nombres exceden los 1024 bytes. Los atacantes pueden enviar un \u00fanico paquete TCP en el puerto 7624 con etiquetas XML no coincidentes para activar una escritura sprintf() sin l\u00edmites en un b\u00fafer de pila fijo de 1024 bytes en MsgQueue.cpp, terminando el demonio e interrumpiendo todas las sesiones activas de cliente y controlador."}], "lastModified": "2026-10-23T16:10:00.313", "sourceIdentifier": "disclosure@vulncheck.com"}