Description
A vulnerability was found in ThakeeNathees pocketlang up to cc73ca61b113d48ee130d837a7a8b145e41de5ce. The affected element is the function pkByteBufferAddString. The manipulation of the argument length with the input 4294967290 results in memory corruption. The attack requires a local approach. The exploit has been made public and could be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-03-12
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Local Memory Corruption
Action: Assess Impact
AI Analysis

Impact

A vulnerability was identified in the pkByteBufferAddString function of ThakeeNathees pocketlang, which occurs when a caller supplies a length of 4,294,967,290. This large length value causes a buffer overflow and results in memory corruption. The weakness is a classic unbounded write, matching CWE‑119. The CVE description notes that exploitation requires local access and a public exploit exists.

Affected Systems

All versions of ThakeeNathees pocketlang up to commit cc73ca61b113d48ee130d837a7a8b145e41de5ce are potentially affected. The project does not use formal versioning, so no specific unaffected releases are identified. Consequently, any current installation should be treated as vulnerable until the upstream project releases a fix.

Risk and Exploitability

The CVSS score for this issue is 4.8, indicating medium severity, while the EPSS score is under 1%, suggesting a low chance of exploitation at present. The vulnerability is not listed in CISA's KEV catalog. Because the exploit requires local execution privileges, the risk to systems without local access is limited. However, if local access is available, memory corruption could lead to crashes, data integrity issues, or denial of service.

Generated by OpenCVE AI on March 18, 2026 at 16:05 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Check the ThakeeNathees/pocketlang GitHub repository for any updates or bug‑fix releases and apply them as soon as available.
  • If no patch is available, review and modify the pkByteBufferAddString code to enforce bounds‑checking on the length parameter.
  • Reduce or eliminate use of the vulnerable function in your application if possible.
  • Monitor the project’s issue tracker and security advisories for announcements of a fix or additional mitigations.

Generated by OpenCVE AI on March 18, 2026 at 16:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 13 Mar 2026 10:00:00 +0000

Type Values Removed Values Added
First Time appeared Thakeenathees
Thakeenathees pocketlang
Vendors & Products Thakeenathees
Thakeenathees pocketlang

Thu, 12 Mar 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 12 Mar 2026 07:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in ThakeeNathees pocketlang up to cc73ca61b113d48ee130d837a7a8b145e41de5ce. The affected element is the function pkByteBufferAddString. The manipulation of the argument length with the input 4294967290 results in memory corruption. The attack requires a local approach. The exploit has been made public and could be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Title ThakeeNathees pocketlang pkByteBufferAddString memory corruption
Weaknesses CWE-119
References
Metrics cvssV2_0

{'score': 1.7, 'vector': 'AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Thakeenathees Pocketlang
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-12T13:37:08.805Z

Reserved: 2026-03-11T19:03:54.877Z

Link: CVE-2026-4010

cve-icon Vulnrichment

Updated: 2026-03-12T13:37:05.195Z

cve-icon NVD

Status : Deferred

Published: 2026-03-12T08:16:11.380

Modified: 2026-04-22T21:30:26.497

Link: CVE-2026-4010

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-20T15:50:01Z

Weaknesses