CVE-2026-12220

Deferred Deferred - Pending Action

Stack-Based Buffer Overflow in Yealink SIP-T46U Firmware

Publication date: 2026-06-15

Last updated on: 2026-06-27

Assigner: VulDB

Description

A vulnerability has been found in Yealink SIP-T46U 108.86.0.118. This affects the function mod_upgrade.SparePartsUpload of the file /api/upgrade/accupgradebychunk of the component Firmware Chunk Upload handler. Such manipulation of the argument uid leads to stack-based buffer overflow. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure and is working on a patch to fix it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-15

Last Modified

2026-06-27

Generated

2026-07-05

AI Q&A

2026-06-15

EPSS Evaluated

2026-07-04

NVD

CVE-2026-12220

EUVD

EUVD-2026-36693

Affected Vendors & Products

Vendor	Product	Version / Range
yealink	sip-t46u	108.86.0.118

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-121	A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
CWE-119	The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Yealink SIP-T46U device, specifically in the Firmware Chunk Upload handler component. It involves the function mod_upgrade.SparePartsUpload within the file /api/upgrade/accupgradebychunk. The issue arises from manipulation of the argument 'uid', which leads to a stack-based buffer overflow. This means that an attacker can cause the device to overwrite parts of its memory, potentially leading to unexpected behavior or control over the device.

The attack can only be initiated from within the local network, limiting its exposure to remote attackers. The vulnerability has been publicly disclosed, and the vendor did not respond to the disclosure.

Impact Analysis

Exploitation of this vulnerability can lead to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code, cause a denial of service, or gain elevated privileges on the affected device.

Since the vulnerability affects confidentiality, integrity, and availability (as indicated by the CVSS scores), an attacker could potentially compromise sensitive communications, disrupt phone services, or take control of the device.

However, the attack requires local network access, so the risk is limited to attackers who have access to the same network as the device.

Hi! I’m here to help you understand CVE-2026-12220. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70