The vulnerability is a stack-based buffer overflow in the JSON parsing component of TeamDavid’s Webbox API (CWE‑787). An attacker can send a JSON body that is at least 8 characters long and begins with a numeric value, causing a crash and denial of service. If a related vulnerability leaks the stack canary, the overflow could be leveraged to execute arbitrary code and fully compromise the server. This issue affects TeamDavid before Rollout 528.

The affected product is Tobit Laboratories AG’s TeamDavid Webbox application, affecting releases up through Rollout 528. All versions preceding that fix remain vulnerable. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerability is no longer exposed via this endpoint. The application exposes an API endpoint that processes JSON requests.

Based on the description, it is inferred that an unauthenticated attacker can exploit the API endpoint over the network by sending a specially crafted JSON payload. The high CVSS score of 9.5 indicates critical severity while the EPSS score is <1% indicating a low probability of exploitation, and the vulnerability is not currently listed in CISA KEV. If the attacker also exploits a separate flaw that reveals the stack canary, the buffer overflow could be used to execute arbitrary code and fully compromise the server.