apcupsd CVE-2026-103436

Exploitation requires that apcupsd's optional CGI web interface (upsstats.cgi, multimon.cgi, or upsfstats.cgi from src/cgi/) be built, deployed, and network-reachable - a non-default optional component, not part of the core daemon. The specific trigger is the single-field path in getupsvar() where a matched STATUS line contains fewer than three whitespace-separated tokens, causing sscanf("%*s %*s %s", answer) to make no assignment while the function still returns success. Limiting factors: the disclosure is confined to uninitialized stack memory (contents non-deterministic and often not sensitive), high attack complexity (AC:H) reflects the narrow parsing condition, and the CGI feature must be exposed rather than the daemon alone; no authentication or user interaction is needed once the endpoint is reachable.

This is a low-severity information-disclosure issue and should be treated as low priority despite the network attack vector. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N, base 3.7) is internally consistent with the description: exploitation is unauthenticated and remote but carries high attack complexity (AC:H) because it depends on a specific parsing edge case - a matched STATUS line containing fewer than three whitespace-separated tokens - and the leaked data is uninitialized stack memory whose contents are non-deterministic, justifying only C:L with no integrity or availability impact. No EPSS score, KEV listing, POC, or SSVC decision data was provided in the input; per precision rules this is 'no public exploit identified at time of analysis.' There are no conflicting signals: the description, CWE-457 (use of uninitialized resource), and the CVSS vector all align on a limited memory-disclosure weakness. The practical ceiling is leakage of small, opportunistic fragments of process stack memory via the CGI HTTP response, not reliable disclosure of secrets, so this is a genuine but minor issue rather than a high-impact flaw.

An attacker who can reach the apcupsd CGI endpoints (upsstats.cgi, multimon.cgi, or upsfstats.cgi) requests a UPS status variable whose matched STATUS line has fewer than three whitespace-separated tokens; getupsvar()'s sscanf performs no assignment yet returns success, so the uninitialized 'answer' buffer is rendered into the HTTP response. Repeated requests may leak differing fragments of stack memory. No public exploit code is identified at time of analysis, and the high complexity means the leak is opportunistic rather than reliably targeted.