Heap-based Buffer Overflow in MMS Library

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: ICS-CERT

Description

The affected product is vulnerable to a heap-based buffer overflow via a crafted MMS Initiate request. Remote code execution (RCE) has been demonstrated when ASLR is disabled; memory corruption or denial of service may occur in configurations where ASLR is enabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-23

Last Modified

2026-07-23

Generated

2026-07-24

AI Q&A

2026-07-24

EPSS Evaluated

N/A

NVD

CVE-2026-49035

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

This vulnerability is a heap-based buffer overflow triggered by a specially crafted MMS Initiate request. It can lead to memory corruption, denial of service, or remote code execution if ASLR is disabled. Even with ASLR enabled, memory corruption or denial of service may still occur.

Impact Analysis

An attacker could exploit this to execute arbitrary code on your system, crash applications, or disrupt services. The impact depends on system configuration, particularly whether ASLR is enabled or disabled.

Mitigation Strategies

Enable ASLR if disabled to reduce risk of remote code execution. Monitor network traffic for unusual MMS Initiate requests. Apply vendor patches or updates if available. Restrict network access to the affected product where possible.

Hi! I’m here to help you understand CVE-2026-49035. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70