EUVD-2026-82395
GHSA-j395-f5mc-4872
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local library overflow reachable via crafted device/data input (AV:L), low complexity and no auth per vendor, with memory disclosure and code execution giving full C/I/A.
Primary rating from Vendor (ni).
CVSS VectorVendor: ni
Lifecycle Timeline
3DescriptionCVE.org
There is stack-based buffer overflow vulnerability recently discovered in MCC Universal Library for Linux (uldaq). This may result in information disclosure or arbitrary code execution. This vulnerability affects MCC Universal Library for Linux (uldaq) v1.2.1 and prior versions.
Articles & Coverage 1
AnalysisAI
Stack-based buffer overflow in MCC Universal Library for Linux (uldaq) 1.2.1 and earlier lets a local attacker corrupt memory inside any process that loads the library, yielding arbitrary code execution or information disclosure at that process's privilege level. Exploitation requires crafted input to reach the vulnerable parsing routine - realistically an attacker-controlled or spoofed MCC USB data-acquisition device attached to the host, or attacker-supplied data processed by an application linked against uldaq - and needs no credentials and no user interaction (CVSS 4.0 8.6; assessed CVSS 3.1 8.4-equivalent vector AV:L/AC:L/PR:N/UI:N). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires local delivery of crafted input to the uldaq library - realistically an attacker-controlled or spoofed MCC USB data-acquisition device connected to the host, or attacker-controlled data processed by an application that links against uldaq v1.2.1 or earlier on Linux. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely high-impact but access-constrained flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fixed uldaq release identified in the NI security advisory at https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/stack-based-buffer-overflow-vulnerability-linux-uldaq.html - the provided data indicates vendor security updates are available but does not specify an exact patched version number, so confirm the target version against the advisory before deploying rather than assuming 1.2.2 or any other number. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux systems for uldaq versions 1.2.1 and earlier using package queries (e.g., dpkg -l | grep uldaq or rpm -qa | grep uldaq), and disable automatic USB device mounting or restrict physical access to USB ports on those systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-121 – Stack-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today