What is the CVSS score of EUVD-2026-26358?

EUVD-2026-26358 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of ASR Kestrel are affected by EUVD-2026-26358?

CVE-2026-42799 affects ASR Kestrel's power control module, allowing authenticated users with low-privilege credentials to read out-of-bounds memory and potentially compromise system integrity.. A patch is available.

How to fix or mitigate EUVD-2026-26358?

Within 24 hours: Inventory all ASR Kestrel deployments and identify systems accessible to low-privilege users. Within 7 days: Apply vendor patch released February 10, 2026, to all affected instances, prioritizing production systems; validate patch deployment. Within 30 days: Audit user access logs for the nr_fw power control module to detect potential exploitation; implement network segmentation to restrict authenticated access to Kestrel systems.

ASR Kestrel EUVD-2026-26358

| CVE-2026-42799 HIGH

Out-of-bounds Read (CWE-125)

2026-04-30 ASR

Buffer Overflow Information Disclosure Kestrel

7.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Apr 30, 2026 - 15:31 EUVD

Patch released

Apr 30, 2026 - 15:09 nvd

Patch available

Analysis Generated

Apr 30, 2026 - 09:30 vuln.today

EUVD ID Assigned

Apr 30, 2026 - 09:00 euvd

EUVD-2026-26358

Analysis Generated

Apr 30, 2026 - 09:00 vuln.today

CVE Published

Apr 30, 2026 - 08:36 nvd

HIGH 7.4

DescriptionCVE.org

Out-of-bounds read vulnerability in ASR Kestrel (nr_fw modules) allows Overflow Buffers.

This vulnerability is associated with program files Code/Nr/nr_fw/RA/src/NrPwrCtrl.C.

This issue affects Kestrel: before 2026/02/10.

AnalysisAI

Out-of-bounds read in ASR Kestrel's nr_fw power control module enables authenticated remote attackers to trigger buffer overflow conditions, potentially disclosing sensitive information and compromising system integrity with low-to-moderate impact across security boundaries. Exploitable over the network with low complexity by attackers holding low-privilege credentials. EPSS data unavailable; not currently listed in CISA KEV. Vendor advisory confirms patch released February 10, 2026.

Technical ContextAI

The vulnerability resides in the nr_fw module's power control component (NrPwrCtrl.C), part of ASR Kestrel's Radio Access (RA) subsystem for New Radio (5G NR) functionality. CWE-125 out-of-bounds read occurs when code accesses memory beyond allocated buffer boundaries without writing, typically during parsing or data processing operations. In telecommunications baseband processors and firmware, such flaws can expose cryptographic material, configuration data, or adjacent memory contents. The affected CPE string (cpe:2.3:a:asr:kestrel:*:*:*:*:*:*:*:*) indicates impact across all Kestrel versions prior to the February 2026 release, suggesting the flaw existed in the power control logic across multiple firmware iterations.

RemediationAI

Upgrade ASR Kestrel firmware to the version released on or after February 10, 2026, which addresses the out-of-bounds read in the nr_fw power control module. Consult the vendor Product Security Incident Response Team (PSIRT) advisory at https://www.asrmicro.com/en/goods/psirt?cid=44 for specific firmware build numbers, installation procedures, and compatibility notes for your deployment. If immediate patching is infeasible in production telecommunications environments, implement network segmentation to restrict access to Kestrel management interfaces to trusted administrator networks only, reducing exposure to the PR:L (low-privilege authenticated) attack vector. Monitor authentication logs for suspicious low-privilege account activity targeting nr_fw module endpoints. Consider application-layer firewall rules to block unusual power control API requests if such granular controls are supported. Note that access restrictions reduce exploitation probability but do not eliminate the underlying memory safety flaw-patching remains the definitive remediation.