CVE Watch23 jul 2026

CVE-2026-39461

libcasper(3) communicates with helper processes via UNIX domain sockets, and uses the select(2) system call to wait for data to become avail

CVSS

8.8

Alto

EPSS

0.2%

KEV

—

Exploit Today

0-100

Publicado: 21 may 2026 · Última mod.: 23 jul 2026 · CWE-121

EPSS · 30d

0.2%EPSS · 30 días0.2%

2026-07-062026-08-02

Descripción técnica

libcasper(3) communicates with helper processes via UNIX domain sockets, and uses the select(2) system call to wait for data to become available. However, it does not verify that its socket descriptor fits within select(2)'s descriptor set size limit of FD_SETSIZE (1024). An attacker able to cause an application using libcasper(3) to allocate large file descriptors, e.g., by opening many descriptors and executing a program which is not careful to close them upon startup, may trigger stack corruption. If the target application runs with setuid root privileges, this could be used to escalate local privileges.

Referencias oficiales

security.freebsd.orghttps://security.freebsd.org/advisories/FreeBSD-SA-26:22.libcasper.asc

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-186078.8 ALT

—

———A security vulnerability has been detected in Wavlink WN572, WN570H, WN573, WN529, WN530, WN531, WN535, etc. WN529, WN530, WN531, WN535, WN536, WN551, WN557 and NU516 up to 20260609. Affected by this issue is the function strcpy of the file upload.cgi of the component lighttpd. The manipulation of the argument HTTP_COOKIE leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.11h CVE-2026-185899.8 CRÍ

—

——0A vulnerability was found in Wavlink WL-NU516U1 708c073-mt7628. This impacts the function change_password of the file nas.cgi. The manipulation of the argument User1Passwd results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.12h CVE-2026-185889.8 CRÍ

—

——0A vulnerability has been found in Wavlink WL-NU516U1 708c073-mt7628. This affects the function fgets of the file nas.cgi. The manipulation of the argument CONTENT_LENGTH leads to stack-based buffer overflow. Remote exploitation of the attack is possible. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.16h CVE-2026-678229.8 CRÍ

21.8%

——7Tenda W6-S 1.0.0.4(510) contains a stack-based buffer overflow vulnerability in the /goform/wifiSSIDset endpoint. The function formwrlSSIDset uses sprintf to copy user-controlled 'GO' and 'index' parameters into a 64-byte stack buffer without length restriction, leading to stack overflow.4d CVE-2026-157227.5 ALT

40.7%

——12A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in repl5_ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP server by sending a crafted StartNSDS50ReplicationRequest extended operation containing a replica ID field with more than 16 digit characters. The overflow occurs during payload decoding, before any authorization check. Stack protectors limit impact to denial of service.16h CVE-2026-438327.5 ALT

15.8%

——5Full details and mitigation steps are currently restricted and will be published at a later date.4d