Keil MDK-Middleware EUVD-2026-109921

Exploitation requires a deployment that actually includes and enables the MDK-Middleware FTP Server component running version 8.3.0, and that this FTP service is reachable by the attacker over the network; the flaw is an out-of-bounds read/write in the FTP Server RX buffer (CWE-195, numeric truncation/conversion error) reached via FTP server input. The input CVSS vector indicates no user interaction and no privileges (PR:N), but the sources do not state whether the OOB condition is hit before or after FTP authentication, so a required FTP login cannot be ruled out as a limiting factor. The primary limiter on real-world exposure is that the FTP Server is an optional embedded middleware component, so only firmware/devices that build in and expose it are affected; impact is bounded (no confidentiality loss, partial integrity and availability).

The input CVSS of 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) describes a network-reachable, low-complexity flaw requiring no privileges or user interaction, with bounded impact - no confidentiality loss and only partial integrity and availability impact (consistent with an out-of-bounds read/write confined to the FTP server RX buffer rather than confirmed remote code execution). The decision signals temper the raw score: SSVC records Exploitation as 'none' (no observed or public exploitation), Automatable 'yes', and Technical Impact 'partial', and the vuln.today priority is 'this_month' rather than act_now/emergency. The CVE is not in CISA KEV, no PoC or exploit reference is supplied (the only reference is the Arm vendor advisory), and no EPSS score was provided in the input, so exploitation probability cannot be quantified here. Net: this is a genuine but moderate-priority, patch-on-your-normal-cycle issue, not a drop-everything emergency - its real-world exposure is gated by whether the optional FTP Server component of MDK-Middleware is actually compiled in, enabled, and network-reachable, which the CVSS base vector does not reflect. One caveat to verify: PR:N treats the flaw as pre-authentication, but the input does not state whether the OOB condition is reached before or after FTP login - confirm against the Arm advisory whether an authenticated FTP session is required.

A remote attacker reaches an embedded device whose firmware includes Arm Keil MDK-Middleware 8.3.0 with the FTP Server component enabled and sends crafted FTP protocol data that is mishandled on the way into the server's RX buffer, driving an out-of-bounds read and write. The resulting memory corruption can disrupt the FTP service or affect adjacent memory with limited integrity impact. No public exploit code has been identified at the time of analysis.