A stack buffer overflow occurs in Domoticz’s MochadTCP::MatchLine handler when processing MOCHAD_RFSEC messages. The handler copies up to 1028 bytes of network data into a fixed 50‑byte stack buffer using strcpy without bounds checking, which can corrupt the worker thread’s stack and potentially lead to arbitrary code execution or denial of service. The flaw is a classic CWE‑121 overflow condition.

The vulnerability affects the Domoticz home automation software (domoticz:domoticz). Any deployment that has not applied the patch for this issue is susceptible; specific affected versions are not listed in the advisory, so the entire unpatched code base is at risk.

The CVSS score of 7.5 indicates a high severity of the flaw, and the attack requires an attacker to be on the same local network segment and reach the Mochad TCP bridge on the default port 1099, which has no authentication. While no EPSS score is available, the lack of authentication makes exploitation possible in environments that expose the port. The vulnerability is not currently listed in the CISA KEV catalog. An exploit would likely involve sending a crafted packet to overflow the buffer, corrupt stack memory, and then causing the worker thread to execute arbitrary code or crash.