Description
A vulnerability was determined in NASA Trick 19.6.0. This issue affects the function JSONVariableServerThread::parse_request of the file trick_source/sim_services/JSONVariableServer/JSONVariableServerThread.cpp of the component TCP Socket Handler. This manipulation causes stack-based buffer overflow. The attack is possible to be carried out remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-08-30
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

NASA Trick 19.6.0 contains a stack‑based buffer overflow in the JSONVariableServerThread::parse_request function. The overflow is triggered by an unbounded sscanf on received TCP data, allowing an attacker to corrupt the stack and potentially execute arbitrary code. This flaw can compromise confidentiality, integrity, and availability of the affected process when exploited.

Affected Systems

The vulnerability affects NASA Trick version 19.6.0. No other versions were listed as affected in the available data.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity, but the flaw is exploitable remotely over the network, and there is no EPSS score or KEV listing available. The lack of mitigation from the vendor and the remote attack surface suggest a tangible risk of exploitation if the vulnerable component is exposed to untrusted network traffic.

Generated by OpenCVE AI on August 30, 2026 at 05:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Check NASA for an official patch or newer version of Trick that addresses the buffer overflow
  • If no patch is released, block external access to the TCP socket used by the JSONVariableServer and limit connections to trusted hosts only
  • Compile the application with stack protection options such as stack canaries and enable address space layout randomization to mitigate the impact of remaining buffer overflows

Generated by OpenCVE AI on August 30, 2026 at 05:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 30 Aug 2026 04:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in NASA Trick 19.6.0. This issue affects the function JSONVariableServerThread::parse_request of the file trick_source/sim_services/JSONVariableServer/JSONVariableServerThread.cpp of the component TCP Socket Handler. This manipulation causes stack-based buffer overflow. The attack is possible to be carried out remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Title NASA Trick TCP Socket JSONVariableServerThread.cpp parse_request stack-based overflow
First Time appeared Nasa
Nasa trick
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:a:nasa:trick:*:*:*:*:*:*:*:*
Vendors & Products Nasa
Nasa trick
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Nasa Trick
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-30T04:15:09.966Z

Reserved: 2026-08-29T14:40:19.698Z

Link: CVE-2026-82478

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-30T05:16:59.380

Modified: 2026-08-30T05:16:59.380

Link: CVE-2026-82478

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-30T05:30:06Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow