CVE-2026-71979
Received Received - Intake

Stack Buffer Overflow in INDI indiserver

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: VulnCheck

Description
INDI (Instrument Neutral Distributed Interface) indiserver through 2.2.4.2, fixed in commit 96bbd7f, contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to crash the daemon by sending malformed XML with mismatched tags whose names exceed 1024 bytes. Attackers can send a single TCP packet on port 7624 with mismatched XML tags to trigger an unbounded sprintf() write into a fixed 1024-byte stack buffer in MsgQueue.cpp, terminating the daemon and disrupting all active client and driver sessions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-71979
EUVD
EUVD-2026-60310

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
indi indiserver to 2.2.4.2 (exc)
indi indiserver to 2.2.4.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-71979 is a stack buffer overflow in INDI indiserver versions up to 2.2.4.2. It occurs when the daemon processes malformed XML with mismatched tags exceeding 1024 bytes. The vulnerability is triggered by sending a single TCP packet on port 7624, causing an unbounded sprintf() write into a fixed 1024-byte stack buffer in MsgQueue.cpp. This crashes the daemon and disrupts all active client and driver sessions.

Detection Guidance

Monitor network traffic on port 7624 for malformed XML packets with mismatched tags exceeding 1024 bytes. Use tools like tcpdump or Wireshark to capture and analyze traffic. Check indiserver logs for crashes or unexpected terminations.

Impact Analysis

This vulnerability allows unauthenticated remote attackers to crash the indiserver daemon by sending a single malicious TCP packet. The crash terminates all active client and driver sessions, causing a denial of service. While no control-flow hijack was demonstrated, the primary impact is on availability, disrupting operations dependent on the INDI server.

Compliance Impact

This vulnerability primarily causes a denial of service by crashing the indiserver daemon, disrupting all active client and driver sessions. It does not directly expose or leak data, but prolonged downtime could impact systems handling sensitive data, potentially affecting compliance with availability requirements in standards like GDPR (Article 32) or HIPAA (Security Rule).

Mitigation Strategies

Upgrade indiserver to a version containing commit 96bbd7f or later. Block or restrict access to port 7624 using firewalls. Monitor for suspicious activity and ensure backups of critical data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71979. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart