Which versions of Yealink SIP-T46U are affected by CVE-2026-12221?

Yealink SIP-T46U IP phones (firmware 108.86.0.118) deployed across the organization contain a remotely exploitable memory corruption vulnerability with publicly available proof-of-concept code,…

Is there a public PoC exploit available for CVE-2026-12221?

Yes, a public proof-of-concept exploit is available for CVE-2026-12221. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-12221?

Within 24 hours: Identify all Yealink SIP-T46U devices running firmware 108.86.0.118 via inventory systems and network scans; implement network segmentation to isolate phones to separate VLANs if feasible. Within 7 days: Deploy firewall rules to restrict access to the /api/upgrade/upgrade endpoint from untrusted network segments; disable firmware upload functionality at the network level if operationally feasible; enable logging on phone administrative interfaces. Within 30 days: Contact Yealink for an updated firmware version beyond 108.86.0.118; evaluate replacement of unsupported phones with vendor-confirmed patched models if no update becomes available; implement mandatory network authentication (802.1X) for device ports if not already in place.

Yealink SIP-T46U CVE-2026-12221

Q: What is the CVSS score of CVE-2026-12221?

CVE-2026-12221 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-36694 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-06-15 VulDB

GHSA-3x75-g3h6-5r8m

Buffer Overflow Stack Overflow Sip T46U Yealink

7.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.3 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.0 HIGH

Adjacent-network upload endpoint (AV:A), straightforward overflow (AC:L), requires low-privilege phone account (PR:L), no user interaction, full compromise of the phone firmware yields high C/I/A with no scope change.

3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 06:22 vuln.today

CVSS changed

Jun 15, 2026 - 06:22 NVD

8.6 (HIGH) 7.3 (HIGH)

DescriptionCVE.org

A vulnerability was found in Yealink SIP-T46U 108.86.0.118. This impacts the function sprintf of the file /api/upgrade/upgrade of the component Firmware Chunk Upload Handler. Performing a manipulation of the argument uid/start_offset results in stack-based buffer overflow. The attack needs to be approached within the local network. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Stack-based buffer overflow in the Yealink SIP-T46U IP phone (firmware 108.86.0.118) allows adjacent-network attackers with low privileges to corrupt memory via crafted uid or start_offset parameters sent to the /api/upgrade/upgrade firmware chunk upload endpoint. Publicly available exploit code exists, and the vendor did not respond to coordinated disclosure, leaving deployed devices without an official patch. CVSS 4.0 rates this 8.6 (High) with proof-of-concept maturity (E:P).

Technical ContextAI

The Yealink SIP-T46U is a desktop VoIP/SIP business phone whose firmware exposes an HTTP-based management API. The vulnerable code path handles chunked firmware upload through /api/upgrade/upgrade and copies the attacker-supplied uid and start_offset parameters into a fixed-size stack buffer using sprintf, a function that performs no bounds checking. This is a classic CWE-121 (Stack-based Buffer Overflow) caused by an unsafe format-string copy of untrusted input, which can overwrite the saved return address and adjacent stack frames on the device's embedded Linux-based controller (cpe:2.3:a:yealink:sip-t46u).

RemediationAI

No vendor-released patch identified at time of analysis, as Yealink did not respond to disclosure outreach - affected operators should monitor https://support.yealink.com for a future firmware release above 108.86.0.118 and apply it as soon as published. Until a fix exists, restrict access to the phone's HTTP management interface by placing SIP-T46U devices on a dedicated VoIP VLAN with ACLs blocking management traffic from user workstations (trade-off: complicates legitimate provisioning tools), disable or firewall the /api/upgrade/upgrade endpoint at a network-layer reverse proxy if one fronts the device (trade-off: blocks remote firmware updates), enforce strong credentials and rotate the low-privilege accounts that can reach the upgrade API since PR:L is required, and monitor LAN traffic to the phone for anomalous POSTs to /api/upgrade/upgrade with oversized uid or start_offset values. The public exploit archive at http://cdn2.v50to.cc/T46U/T46U_mod_upgrade_Upgrade_chunk_stack_overflow.zip can be used to validate detection signatures in a lab.