A buffer overflow vulnerability exists in D‑Link DI‑8003 firmware 16.07.26A1 caused by improper handling of the http_lanport parameter in the /webgl.asp endpoint. This allows an attacker to provide an overly long or crafted value that overflows memory and can potentially execute arbitrary code, compromising the device’s confidentiality, integrity, or availability. The weakness is a classic stack-based buffer overflow (CWE‑120).

The affected product is D‑Link DI‑8003 running firmware version 16.07.26A1. No other versions or products are listed as affected.

The CVSS score of 7.5 indicates a high severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via an HTTP request sent to the /webgl.asp endpoint, which can be accessed from devices on the local network, allowing a local network adversary to exploit the overflow.