CVE-2025-26386: Stack-based Buffer Overflow in Johnson Controls iSTAR Configuration Utility (ICU) tool
Johnson Controls iSTAR Configuration Utility (ICU) has Stack-based Buffer Overflow vulnerability. This issue affects iSTAR Configuration Utility (ICU) version 6.9.7 and prior. Successful exploitation of this vulnerability could result in failure within the operating system of the machine hosting the ICU tool.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-26386?
CVE-2025-26386 is classified as a critical vulnerability due to its potential for remote code execution resulting from a stack-based buffer overflow.
How do I fix CVE-2025-26386?
To remediate CVE-2025-26386, users should update the Johnson Controls iSTAR Configuration Utility to version 6.9.8 or later, which resolves the vulnerability.
What are the risks associated with CVE-2025-26386?
The risks associated with CVE-2025-26386 include potential unauthorized access and control over the affected system, leading to further exploitation by attackers.
Which systems are affected by CVE-2025-26386?
CVE-2025-26386 specifically affects the Johnson Controls iSTAR Configuration Utility version 6.9.7 and earlier.
Is there a workaround for CVE-2025-26386?
Currently, there are no recommended workarounds for CVE-2025-26386, and the only solution is to upgrade to the patched version.