CVE-2026-19508

RDK WebUI heap-based buffer overflow vulnerability

View on CVE.org
Published Aug 19, 2026 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Description
Heap-based buffer overflow in the multipart form-data parser in `jst_post.c` in RDK-B WebUI `rdkb-2025q4-kirkstone.04.10.26` allows a remote unauthenticated attacker to cause memory corruption and denial of service, and potentially execute arbitrary code, via a crafted multipart/form-data request.

Analysis

AI-generated

Technical impact

The RDK-B WebUI contains a heap-based buffer overflow in the multipart form-data parser implemented in jst_post.c. A specially crafted multipart form-data request can corrupt memory, cause a denial of service, and potentially enable arbitrary code execution by a remote attacker without authentication.

Affected Systems

The vulnerability affects the RDK-B WebUI component of the RDK consortium, specifically the rdkb-2025q4-kirkstone.04.10.26 release. No other releases are listed as affected. The product is a web interface used in broadband routers.

Risk and Exploitability

The flaw can be exploited from any network that reaches the WebUI, with no authentication required. The CVSS score of 9.8 indicates critical severity. EPSS score of <1% indicates a very low probability of exploitation, and the issue is not listed in CISA’s KEV catalog, yet the remote code execution potential makes it a high-risk vulnerability. The attack vector is inferred to be a malformed multipart form‑data HTTP request sent to the WebUI, though no public exploit evidence is currently documented.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply any vendor‑supplied update that fixes the multipart form‑data parser in RDK‑B WebUI, ensuring the deployment version is newer than rdkb‑2025q4‑kirkstone.04.10.26.
  • Restrict access to the WebUI by enforcing network segmentation or firewall rules that limit traffic to trusted IP addresses.
  • Enable detailed logging and monitor for abnormal multipart form‑data traffic that could indicate an attempt to exploit the buffer overflow.
  • Consider deploying a Web Application Firewall or reverse proxy that validates multipart payload sizes and MIME types before forwarding requests to the WebUI.

Generated by OpenCVE AI on August 28, 2026 at 06:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Weaknesses CWE-119
Type Values Removed Values Added
Weaknesses CWE-122
Type Values Removed Values Added
First Time appeared Rdk
Rdk rdk-b Webui
Vendors & Products Rdk
Rdk rdk-b Webui
Type Values Removed Values Added
Weaknesses CWE-122
Type Values Removed Values Added
Description Heap-based buffer overflow in the multipart form-data parser in `jst_post.c` in RDK-B WebUI `rdkb-2025q4-kirkstone.04.10.26` allows a remote unauthenticated attacker to cause memory corruption and denial of service, and potentially execute arbitrary code, via a crafted multipart/form-data request.
Title RDK WebUI heap-based buffer overflow vulnerability
References
Earlier changes (1)
Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

Sources

Status
PUBLISHED
Assigner
certcc
Published
Updated
Aug 27, 2026, 5:19 PM
Reserved
Aug 10, 2026, 7:14 PM

View source JSON

Updated
Aug 27, 2026, 5:19 PM

JSON

Status
Awaiting Analysis
Published
Aug 19, 2026, 8:17 PM
Modified
Sep 3, 2026, 5:42 PM

View source JSON

No data.

Updated
Aug 28, 2026, 6:15 AM

JSON