EUVD-2026-80872Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description states a stack overflow leading to remote execution, which implies full code-execution compromise (C:H/I:H/A:H); adjacent unauthenticated no-UI matches the vector, contra the vendor's availability-only impact.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
3DescriptionCVE.org
Dell Update Package Framework, versions prior to 26.07.03, contains a Stack-based Buffer Overflow vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Remote execution.
AnalysisAI
Stack-based buffer overflow in the Dell Update Package (DUP) Framework, affecting all versions prior to 26.07.03, allows an unauthenticated attacker who can reach the affected component from an adjacent network segment (AV:A, PR:N, UI:N) to corrupt stack memory and potentially achieve code execution or crash the process. Dell scores this 6.5 with CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (availability-only), whereas independent assessment rates the impact as complete loss of confidentiality, integrity and availability (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which aligns with the description's statement that the flaw can lead to remote execution; the practical constraint in both readings is the adjacency requirement rather than internet-wide reachability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the Dell Update Package (DUP) Framework at a version prior to 26.07.03 to be running and reachable from the attacker's network position. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor scores this 6.5 with vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, meaning unauthenticated adjacent-network access, low complexity, no user interaction, and impact limited to availability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: 26.07.03 - upgrade the Dell Update Package Framework to 26.07.03 or later, following the instructions in Dell advisory DSA-2026-417 (https://www.dell.com/support/kbdoc/en-us/000509455/dsa-2026-417-security-update-for-dell-update-package-dup-framework-vulnerabilities), and verify the framework version on each host rather than only patching the operating system, since the framework is a separately versioned component. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Update Package Framework
View allDell Update Package Framework versions 23.12.00 through 24.12.00 suffers from improper privilege handling that allows lo
Local privilege escalation in Dell Update Package (DUP) Framework versions prior to 26.07.03 lets a low-privileged local
Local privilege escalation in the Dell Update Package (DUP) Framework (versions prior to 26.07.03) allows an attacker wh
An Uncontrolled Search Path Vulnerability is applicable to the following: Dell Update Package (DUP) Framework file versi
A link-following (symlink) defect in the Dell Update Package (DUP) Framework before version 26.07.03 allows a locally au
Improper link resolution in the Dell Update Package (DUP) Framework before 26.07.03 allows an attacker who already holds
Dell Update Package Framework, versions prior to 22.01.02, contain(s) a Local Privilege Escalation Vulnerability. Rated
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today