CVE-2026-38821

Deferred Deferred - Pending Action

Heap Overflow in openNDS Before 11.0.0

Publication date: 2026-08-28

Last updated on: 2026-09-09

Assigner: MITRE

Description

A heap-based buffer overflow vulnerability exists in openNDS before 11.0.0 that allows an unauthenticated attacker on the captive portal network to crash the openNDS daemon (denial of service) and potentially achieve remote code execution. This is in http_microhttpd.c.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-09

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-38821

EUVD

EUVD-2026-67361

Affected Vendors & Products

Vendor	Product	Version / Range
opends	opends	to 11.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

This is a heap-based buffer overflow vulnerability in openNDS before version 11.0.0. It occurs in the http_microhttpd.c file and is triggered by an unauthenticated attacker on the captive portal network sending specially crafted input. The issue stems from insufficient memory allocation for the querystr variable, which can lead to buffer overflows.

Detection Guidance

To detect this vulnerability, check the version of openNDS running on your system. If it is before 11.0.0, it is vulnerable. Use commands like 'opennds --version' or 'dpkg -l | grep opennds' to verify the installed version.

Impact Analysis

An attacker could exploit this to crash the openNDS daemon, causing a denial of service. In some cases, it may also allow remote code execution, potentially giving the attacker control over the affected system.

Compliance Impact

This vulnerability could potentially lead to unauthorized access or data breaches due to remote code execution or denial of service, which may violate compliance requirements under GDPR and HIPAA. Unauthorized access to personal or health data could result in legal penalties or loss of certification.

Mitigation Strategies

Immediately upgrade openNDS to version 11.0.0 or later to address the heap-based buffer overflow vulnerability. This version includes a fix that increases the buffer size for query strings to prevent overflows.

Hi! I’m here to help you understand CVE-2026-38821. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70