CVE-2022-26507: Buffer Overflow
UNSUPPORTED WHEN ASSIGNED A heap-based buffer overflow exists in XML Decompression DecodeTreeBlock in AT&T Labs Xmill 0.7. A crafted input file can lead to remote code execution. This is not the same as any of: CVE-2021-21810, CVE-2021-21811, CVE-2021-21812, CVE-2021-21815, CVE-2021-21825, CVE-2021-21826, CVE-2021-21828, CVE-2021-21829, or CVE-2021-21830. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-26507?
CVE-2022-26507 is a heap-based buffer overflow vulnerability in XML Decompression DecodeTreeBlock in AT&T Labs Xmill 0.7, which can be exploited to achieve remote code execution.
What is the severity of CVE-2022-26507?
The severity of CVE-2022-26507 is critical, with a CVSS score of 9.8.
Which software products are affected by CVE-2022-26507?
The affected software products include Att Xmill 0.7, Schneider-electric Ecostruxure Control Expert (up to version 15.1), Schneider-electric Ecostruxure Process Expert (up to version 2021), and Schneider-electric Remoteconnect.
How can CVE-2022-26507 be exploited?
CVE-2022-26507 can be exploited by crafting a malicious input file to trigger the heap-based buffer overflow, which may result in remote code execution.
Is there a fix available for CVE-2022-26507?
At the moment, there is no fix available for CVE-2022-26507. It is advisable to follow the recommendations provided by the vendor or security advisories.