What is the CVSS score of CVE-2026-36228?

CVE-2026-36228 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Easy Chat Server are affected by CVE-2026-36228?

Easy Chat Server 3.1 contains a high-severity remote code execution vulnerability exploitable via buffer overflow in chat message handling, with publicly available exploit code and no vendor-issued…

How to fix or mitigate CVE-2026-36228?

Within 24 hours: Identify all systems running Easy Chat Server 3.1; immediately implement firewall rules restricting network access to authorized sources only. Within 7 days: Deploy intrusion detection signatures; segment affected servers onto isolated network; document all users, use cases, and dependencies. Within 30 days: Migrate to alternative chat solutions with active security updates, or decommission Easy Chat Server 3.1; if business-critical to retain, implement permanent network segmentation with real-time monitoring, offline backup procedures, and quarterly risk assessments.

Easy Chat Server CVE-2026-36228

EUVD-2026-31472 HIGH

Classic Buffer Overflow (CWE-120)

2026-05-22 mitre

GHSA-jh5j-c5cw-c6g9

RCE Buffer Overflow N A

7.3

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

9.8 CRITICAL

Remote unauthenticated buffer overflow yielding arbitrary code execution warrants AV:N/AC:L/PR:N/UI:N and high C/I/A; the vendor's C:L/I:L/A:L understates true RCE impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 02:25 vuln.today

CVSS changed

Jul 05, 2026 - 02:22 NVD

7.3 (None) 7.3 (HIGH)

CVE Published

May 22, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Buffer Overflow vulnerability in Easy Chat Server 3.1 allows a remote attacker to obtain sensitive information and execute arbitrary code via the chat message functionality

AnalysisAI

Remote code execution in Easy Chat Server 3.1 stems from a buffer overflow in the chat message handling functionality, letting remote attackers overwrite memory to leak sensitive data and run arbitrary code on the hosting Windows machine. The product is a small standalone web-based chat server historically used as an exploit-development target, and publicly available exploit code exists (GitHub PoC), though EPSS is low (0.18%, 39th percentile) and it is not on CISA KEV. No public evidence of active in-the-wild exploitation was identified at time of analysis.

Technical ContextAI

Easy Chat Server is a lightweight standalone HTTP-based chat server application for Windows that exposes a web interface for real-time messaging. The flaw is classified as CWE-120 (Classic Buffer Overflow / copy without checking input size): the chat message processing routine copies attacker-supplied input into a fixed-size stack or heap buffer without bounds validation, allowing the buffer boundary to be exceeded. Overwriting adjacent memory (including saved return addresses or control structures) enables both disclosure of adjacent memory contents and hijacking of execution flow to attacker-controlled shellcode. CPE data in the feed is a placeholder ('cpe:2.3:a:n/a:n/a') and does not further constrain the affected component beyond the vendor description of the chat message functionality.

RemediationAI

No vendor-released patched version is identified at time of analysis, and the only vendor reference (http://easy.com) provides no confirmed fixed build, so treat this as unpatched. Because Easy Chat Server 3.1 is legacy, exploit-targeted software, the strongest control is to decommission or replace it with a maintained chat platform. If it must remain running, restrict network exposure by placing the service behind a firewall or reverse proxy that limits access to trusted internal clients only, block inbound access to its HTTP listener port from untrusted networks, and monitor the host for anomalous child-process spawning from the server binary - the trade-off is loss of public/remote chat accessibility. Consult the NVD advisory (https://nvd.nist.gov/vuln/detail/CVE-2026-36228) for updates; do not rely on invented version numbers, as none are confirmed in the source data.