CVE-2026-19508

Awaiting Analysis Awaiting Analysis - Queue

Heap-based Buffer Overflow in RDK-B WebUI

Publication date: 2026-08-19

Last updated on: 2026-09-03

Assigner: CERT/CC

Description

Heap-based buffer overflow in the multipart form-data parser in `jst_post.c` in RDK-B WebUI `rdkb-2025q4-kirkstone.04.10.26` allows a remote unauthenticated attacker to cause memory corruption and denial of service, and potentially execute arbitrary code, via a crafted multipart/form-data request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-09-03

Generated

2026-09-09

AI Q&A

2026-08-20

EPSS Evaluated

2026-09-07

NVD

CVE-2026-19508

EUVD

EUVD-2026-62718

Affected Vendors & Products

Vendor	Product	Version / Range
rdk	rdk-b_webui	2025q4-kirkstone.04.10.26

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-119	The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

Executive Summary

This is a heap-based buffer overflow in the multipart form-data parser of RDK-B WebUI. It occurs in the file jst_post.c and allows a remote unauthenticated attacker to corrupt memory and cause a denial of service. In severe cases, it may enable arbitrary code execution through specially crafted multipart/form-data requests.

Detection Guidance

This vulnerability involves a heap-based buffer overflow in the multipart form-data parser in RDK-B WebUI. Detection requires inspecting network traffic for malformed multipart/form-data requests targeting the vulnerable component. Use packet capture tools like tcpdump or Wireshark to monitor and analyze incoming HTTP POST requests with multipart/form-data content types. Check server logs for segmentation faults or crashes in the WebUI process.

Impact Analysis

An attacker could exploit this to crash the affected system, leading to service disruption. If code execution is achieved, they might gain control over the device, steal data, or perform other malicious actions depending on the system's role and configuration.

Compliance Impact

The vulnerability allows remote unauthenticated attackers to cause memory corruption, denial of service, and potentially execute arbitrary code via crafted requests. This could lead to unauthorized access or data breaches, which may violate GDPR and HIPAA compliance requirements for data protection and security.

Mitigation Strategies

Immediately update RDK-B WebUI to the latest patched version if available. If no patch exists, restrict access to the WebUI by blocking external traffic via firewall rules. Disable multipart/form-data parsing temporarily if feasible. Monitor system logs for signs of exploitation attempts. Consider isolating the WebUI server from critical systems until mitigation is confirmed.

Hi! I’m here to help you understand CVE-2026-19508. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70