Which versions of Admesh are affected by CVE-2026-2653?

Organizations using admesh should be aware of moderate risk from CVE-2026-2653, a buffer overflow vulnerability rated CVSS 5.3. Exploitation could cause memory corruption or application crashes.. A patch is available.

Is there a public PoC exploit available for CVE-2026-2653?

Yes, a public proof-of-concept exploit is available for CVE-2026-2653. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-2653?

Within 30 days: Identify affected systems running admesh and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Admesh CVE-2026-2653

Q: What is the CVSS score of CVE-2026-2653?

CVE-2026-2653 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Buffer Overflow (CWE-119)

2026-02-18 cna@vuldb.com

Buffer Overflow Admesh Admesh Project

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 1.9 (LOW)

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 20, 2026 - 16:16 vuln.today

Public exploit code

CVE Published

Feb 18, 2026 - 11:16 nvd

MEDIUM 5.3

DescriptionCVE.org

A security flaw has been discovered in admesh up to 0.98.5. This issue affects the function stl_check_normal_vector of the file src/normals.c. Performing a manipulation results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. It looks like this product is not really maintained anymore.

AnalysisAI

Admesh versions up to 0.98.5 contain a heap buffer overflow in the stl_check_normal_vector function that allows local attackers to corrupt memory with low integrity and confidentiality impact. Public exploit code exists for this vulnerability, and the product appears to be unmaintained with no patch available.

Technical ContextAI

Classified as CWE-119 (Buffer Overflow). Affects Admesh. A security flaw has been discovered in admesh up to 0.98.5. This issue affects the function stl_check_normal_vector of the file src/normals.c. Performing a manipulation results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. It looks like this product is not really maintained anymore.