What is the CVSS score of CVE-2026-30363?

CVE-2026-30363 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Flipper Zero Firmware are affected by CVE-2026-30363?

CVE-2026-30363 is a high-severity stack overflow in Flipper Zero Firmware that allows local attackers to execute arbitrary code with elevated privileges, bypassing authentication controls.

How to fix or mitigate CVE-2026-30363?

Within 24 hours: Inventory all Flipper Zero devices in your organization and identify those running commit ad2a80 or earlier; isolate affected devices from network access and restrict physical access to authorized personnel only. Within 7 days: Monitor the official Flipper Zero GitHub repository and vendor advisories for patch availability; document current firmware versions across all devices and establish a patch deployment procedure. Within 30 days: Apply vendor-released patch immediately upon availability; if no patch emerges, evaluate alternative tools or implement hardware-level access controls to prevent unauthorized local code execution.

Flipper Zero Firmware CVE-2026-30363

EUVD-2026-26705 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-05-01 cve@mitre.org

Stack Overflow Buffer Overflow

8.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 01, 2026 - 21:30 vuln.today

CVSS changed

May 01, 2026 - 21:22 NVD

8.4 (None) 8.4 (HIGH)

EUVD ID Assigned

May 01, 2026 - 19:22 euvd

EUVD-2026-26705

Analysis Generated

May 01, 2026 - 19:22 vuln.today

CVE Published

May 01, 2026 - 19:16 nvd

HIGH 8.4

DescriptionCVE.org

flipperzero-firmware commit ad2a80 was discovered to contain a stack overflow in the "Main" function.

AnalysisAI

Stack overflow in Flipper Zero Firmware (commit ad2a80) enables local arbitrary code execution with high privileges through exploitation of the Main function. SSVC framework confirms POC availability and total technical impact. CVSS 8.4 reflects local attack vector with no authentication barrier. No vendor-released patch identified at time of analysis, though GitHub issue tracking indicates developer awareness.

Technical ContextAI

This vulnerability affects the Flipper Zero Firmware, the operating system for the Flipper Zero portable multi-tool device used for hardware hacking and security research. The flaw is a CWE-121 stack-based buffer overflow in the Main function - likely the firmware's entry point or primary event loop. Stack overflows occur when more data is written to a stack buffer than allocated, overwriting adjacent memory including return addresses. In embedded firmware like Flipper Zero's, successful exploitation can redirect execution flow to attacker-controlled code. The vulnerability exists in commit ad2a80, a specific development snapshot. Flipper Zero runs on ARM Cortex-M processors with constrained memory, where stack overflows can have severe impact due to lack of modern exploit mitigations common in desktop operating systems.

RemediationAI

No vendor-released patch version independently confirmed at time of analysis. Users should monitor the GitHub issue at https://github.com/flipperdevices/flipperzero-firmware/issues/4332 for official vendor guidance and patch availability. Until patched firmware is released, implement these compensating controls: (1) Restrict physical access to Flipper Zero devices - treat as trusted hardware requiring device security controls similar to cryptographic tokens. (2) Disable automatic firmware update mechanisms to prevent supply-chain exploitation if update channels are compromised. (3) Validate firmware integrity using checksums before manual installation. (4) For shared devices in security labs, wipe and reflash firmware between users to clear potential persistence mechanisms. Trade-off: Disabling updates blocks legitimate security patches, so implement strict change control and manual update verification processes. For development teams, audit commits after ad2a80 in the repository to identify if fixes were silently merged without CVE cross-reference.