What is the CVSS score of CVE-2026-61486?

CVE-2026-61486 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Apache Lucy CVE-2026-61486

EUVD-2026-53191 CRITICAL

Stack-based Buffer Overflow (CWE-121)

2026-08-05 apache

GHSA-phfr-gw5r-65ff

Buffer Overflow Apache Stack Overflow Apache Lucy Apache Software Foundation

9.8

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

9.8 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Inferred network vector for a search library accepting external input; no authentication or interaction required; full stack compromise implies high C/I/A.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 08:07 vuln.today

DescriptionCVE.org

UNSUPPORTED WHEN ASSIGNED Stack-based Buffer Overflow vulnerability in Apache Lucy.

This issue affects Apache Lucy: all versions.

As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Articles & Coverage 1

News Critical Stack-Based Buffer Overflow in Apache Lucy - CVE-2026-61486 Aug 06, 2026

AnalysisAI

Stack-based buffer overflow in Apache Lucy (all versions) enables potential arbitrary code execution through crafted input triggering memory corruption in the retired C-based search library. All versions are affected with no patch planned, as the Apache Software Foundation has officially retired the project. No public exploit or active exploitation has been identified at time of analysis, but the absence of any future fix makes this a permanent unresolved risk for any remaining deployments.

Technical ContextAI

Apache Lucy (CPE: cpe:2.3:a:apache_software_foundation:apache_lucy:*:*:*:*:*:*:*:*) was a port of the Apache Lucene search engine to C and Perl, designed for embedding full-text search capabilities into applications. CWE-121 (Stack-based Buffer Overflow) indicates that user-supplied or externally-sourced input is written into a fixed-size stack buffer without adequate bounds checking, allowing an attacker to overwrite adjacent stack memory including return addresses or function pointers, typically enabling control-flow hijacking and arbitrary code execution within the process hosting the library.

RemediationAI

No vendor-released patch identified at time of analysis, and none is planned - the Apache Software Foundation has explicitly stated the project is retired and will not issue a fix. The primary recommended action is migrating to an actively maintained search library such as Apache Lucene (Java), Xapian, or Meilisearch, depending on language and deployment requirements. As an interim compensating control, restrict access to any service or endpoint that accepts input processed by Apache Lucy to trusted, authenticated users only, reducing the attack surface. This control does not eliminate the vulnerability but limits exposure by preventing untrusted input from reaching the vulnerable code path. Organizations should treat any remaining Apache Lucy deployment as end-of-life infrastructure requiring architectural replacement on a defined timeline.