Description
Heap-based buffer overflow in the multipart form-data parser in `jst_post.c` in RDK-B WebUI `rdkb-2025q4-kirkstone.04.10.26` allows a remote unauthenticated attacker to cause memory corruption and denial of service, and potentially execute arbitrary code, via a crafted multipart/form-data request.
Published: 2026-08-19
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The RDK-B WebUI contains a heap-based buffer overflow in the multipart form-data parser implemented in jst_post.c. A specially crafted multipart form-data request can corrupt memory, cause a denial of service, and potentially enable arbitrary code execution by a remote attacker without authentication.

Affected Systems

The vulnerability affects the RDK-B WebUI component of the RDK consortium, specifically the rdkb-2025q4-kirkstone.04.10.26 release. No other releases are listed as affected. The product is a web interface used in broadband routers.

Risk and Exploitability

The flaw can be exploited from any network that reaches the WebUI, with no authentication required. The CVSS score of 9.8 indicates critical severity. EPSS score of <1% indicates a very low probability of exploitation, and the issue is not listed in CISA’s KEV catalog, yet the remote code execution potential makes it a high-risk vulnerability. The attack vector is inferred to be a malformed multipart form‑data HTTP request sent to the WebUI, though no public exploit evidence is currently documented.

Generated by OpenCVE AI on August 28, 2026 at 06:13 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any vendor‑supplied update that fixes the multipart form‑data parser in RDK‑B WebUI, ensuring the deployment version is newer than rdkb‑2025q4‑kirkstone.04.10.26.
  • Restrict access to the WebUI by enforcing network segmentation or firewall rules that limit traffic to trusted IP addresses.
  • Enable detailed logging and monitor for abnormal multipart form‑data traffic that could indicate an attempt to exploit the buffer overflow.
  • Consider deploying a Web Application Firewall or reverse proxy that validates multipart payload sizes and MIME types before forwarding requests to the WebUI.

Generated by OpenCVE AI on August 28, 2026 at 06:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 27 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 00:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119

Thu, 20 Aug 2026 12:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-122

Thu, 20 Aug 2026 09:30:00 +0000

Type Values Removed Values Added
First Time appeared Rdk
Rdk rdk-b Webui
Vendors & Products Rdk
Rdk rdk-b Webui

Thu, 20 Aug 2026 01:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-122

Wed, 19 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Description Heap-based buffer overflow in the multipart form-data parser in `jst_post.c` in RDK-B WebUI `rdkb-2025q4-kirkstone.04.10.26` allows a remote unauthenticated attacker to cause memory corruption and denial of service, and potentially execute arbitrary code, via a crafted multipart/form-data request.
Title RDK WebUI heap-based buffer overflow vulnerability
References

Subscriptions

Rdk Rdk-b Webui
cve-icon MITRE

Status: PUBLISHED

Assigner: certcc

Published:

Updated: 2026-08-27T17:19:56.917Z

Reserved: 2026-08-10T19:14:20.637Z

Link: CVE-2026-19508

cve-icon Vulnrichment

Updated: 2026-08-27T17:19:36.760Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-19T20:17:14.647

Modified: 2026-09-03T17:42:23.907

Link: CVE-2026-19508

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T06:15:03Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer