CVE-2026-18269
Received Received - Intake

Out-of-Bounds Write in Kenwood DNR1007XR Firmware

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: Zero Day Initiative

Description
Kenwood DNR1007XR tchdr_bytestream_read Out-Of-Bounds Write Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DNR1007XR devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the tchdr_bytestream_read function. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-28980.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-18269
EUVD
EUVD-2026-63416

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
kenwood dnr1007xr *
kenwood dnr1007xr to 2026-07-29 (inc)
kenwood dnr1007xr to 2026-07-21 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds write issue in the tchdr_bytestream_read function of the Kenwood DNR1007XR device. It allows physically present attackers to execute arbitrary code with root privileges without authentication due to insufficient validation of user-supplied data, leading to a buffer overflow.

Detection Guidance

Detection requires physical access to the device. Check firmware version against Kenwood's update. Monitor for unexpected crashes or unusual behavior in the DNR1007XR device.

Impact Analysis

An attacker could exploit this flaw to execute malicious code on the device, potentially gaining full control over it. This could lead to unauthorized access, data theft, or disruption of device functionality. Since the device is a Kenwood DNR1007XR, it may be used in critical environments where such breaches could have significant consequences.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using affected devices must address this flaw to maintain data protection standards and avoid potential legal penalties.

Mitigation Strategies

Apply the official firmware update from Kenwood immediately. Ensure physical access to the device is restricted to authorized personnel only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18269. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart