EUVD-2026-23912
GHSA-vxch-4r45-jhw9
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Local-only embedded firmware defect requiring PR:L to deploy; partial C/I/A impact from ISR memory corruption with no scope change.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A stack-use-after-return issue exists in the Arduino_Core_STM32 library prior to version 1.7.0. The pwm_start() function allocates a TIM_HandleTypeDef structure on the stack and passes its address to HAL initialization routines, where it is stored in a global timer handle registry. After the function returns, interrupt service routines may dereference this dangling pointer, resulting in memory corruption.
AnalysisAI
Stack-use-after-return memory corruption in Arduino_Core_STM32 (stm32duino) allows local low-privileged actors to trigger undefined behavior via dangling pointer dereference in interrupt service routines on devices running firmware built with versions prior to 1.7.0. The pwm_start() function stores a stack-allocated TIM_HandleTypeDef pointer in a global HAL timer registry; once the function returns and the stack frame is reclaimed, any timer ISR that fires will dereference a now-invalid pointer, corrupting memory. A researcher disclosure repository (CVE-2026-26399-Disclosure) is publicly referenced, suggesting exploit details exist, though EPSS at 0.02% (5th percentile) and SSVC exploitation status of 'none' confirm no broad active exploitation at time of analysis.
Technical ContextAI
Arduino_Core_STM32 is an Arduino-ecosystem Hardware Abstraction Layer (HAL) library for STM32 Arm Cortex-M microcontrollers, wrapping ST Microelectronics' STM32Cube HAL. The pwm_start() function initializes a PWM timer by allocating a TIM_HandleTypeDef structure on the stack - a common STM32 HAL pattern - and passing its address to HAL_TIM_PWM_Init() and associated routines, which store the pointer in a globally-accessible timer handle registry. After pwm_start() returns, the stack frame is invalidated, but the global registry still holds the original pointer. CWE-825 (Expired Pointer Dereference) precisely describes this class: a pointer is used after the object it references is no longer alive. When a hardware timer interrupt fires post-return, the ISR retrieves the stale handle pointer from the registry and attempts to read or write through it, causing unpredictable memory corruption. CPE data is listed as n/a in available intelligence, indicating NVD has not assigned formal CPE identifiers to this library; product scope is confirmed through the description and GitHub repository context.
RemediationAI
Upgrade Arduino_Core_STM32 to version 1.7.0 or later per the CVE description's stated fix threshold. Note that the referenced GitHub release (https://github.com/stm32duino/Arduino_Core_STM32/releases/tag/1.6.1) is version 1.6.1 and does not document this fix - developers should verify the changelog at the 1.7.0 release tag directly on the stm32duino GitHub repository. As a code-level workaround for teams that cannot immediately upgrade, allocate TIM_HandleTypeDef in static or global scope rather than on the stack within pwm_start() or any caller, ensuring the pointer remains valid for the lifetime of any ISR that may reference it; the trade-off is increased static memory consumption, which may be relevant on resource-constrained STM32 targets. A second compensating control is to disable the relevant timer interrupt (HAL_TIM_Base_Stop_IT or equivalent) before returning from pwm_start() and only re-enabling it after a stable handle location is ensured, though this adds complexity and potential for race conditions. No vendor advisory URL beyond the GitHub release and NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-26399) is available in current intelligence.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-825 – Expired Pointer Dereference
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today