CVE-2026-48490

Received Received - Intake

Stack-Based Buffer Overflow in ArduinoCore-avr

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: GitHub, Inc.

Description

ArduinoCore-avr contains the source code and configuration files of the Arduino AVR Boards platform. A vulnerability in versions prior to 1.8.8 allows an attacker to trigger a stack-based buffer overflow when concatenating floating-point values of sufficiently large magnitude onto an Arduino String object. By passing values near the extremes of the float or double range to `String::concat(float)`, `String::concat(double)`, `String::operator+=()`, or the `+` operator with a float/double operand, `dtostrf()` writes beyond the fixed-size stack buffer, causing memory corruption and denial of service. Under specific conditions, this could enable arbitrary code execution on AVR-based Arduino boards. The fix is included starting from the `1.8.8 `release.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-48490

Affected Vendors & Products

Vendor	Product	Version / Range
arduino	arduino_core_avr	to 1.8.8 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-120	The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is a stack-based buffer overflow in ArduinoCore-avr versions prior to 1.8.8. It occurs when floating-point values of large magnitude are concatenated onto an Arduino String object using functions like String::concat or the + operator. The issue causes dtostrf() to write beyond a fixed-size stack buffer, leading to memory corruption and potential denial of service. In rare cases, it may allow arbitrary code execution on AVR-based Arduino boards.

Detection Guidance

This vulnerability affects ArduinoCore-avr versions prior to 1.8.8. To detect it, check the installed version of ArduinoCore-avr on your system. If you are using an Arduino IDE or platform, verify the version of the AVR board package installed.

Impact Analysis

If exploited, this vulnerability could cause your Arduino device to crash or behave unpredictably. In severe cases, an attacker might execute arbitrary code on the device, potentially taking control of it. This could disrupt any connected systems or processes relying on the Arduino board.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a specific software library (ArduinoCore-avr) and its stack-based buffer overflow issue. Compliance impacts would depend on how the affected library is used in a system handling regulated data.

Mitigation Strategies

Upgrade ArduinoCore-avr to version 1.8.8 or later to apply the fix for the stack-based buffer overflow vulnerability. Remove or replace any vulnerable versions of the library in your projects.

Hi! I’m here to help you understand CVE-2026-48490. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70