CVE-2026-12220: Yealink SIP-T46U Firmware Chunk Upload handler accupgradebychunk mod_upgrade.SparePartsUpload stack-based overflow

Published Jun 15, 2026

Updated

A vulnerability has been found in Yealink SIP-T46U 108.86.0.118. This affects the function modupgrade.SparePartsUpload of the file /api/upgrade/accupgradebychunk of the component Firmware Chunk Upload handler. Such manipulation of the argument uid leads to stack-based buffer overflow. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure and is working on a patch to fix it.

Affected Software

1 affected component

Yealink SIP-T46U=108.86.0.118

Event History

Jun 15, 2026

CVE Published

via MITRE·04:45 AM

Data Sourced

via MITRE·04:45 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-12220?

The severity of CVE-2026-12220 is rated as high with a score of 8.

How do I fix CVE-2026-12220?

To mitigate CVE-2026-12220, update to the latest firmware version provided by Yealink that resolves this vulnerability.

What type of vulnerability is CVE-2026-12220?

CVE-2026-12220 is a stack-based buffer overflow vulnerability.

What device is affected by CVE-2026-12220?

CVE-2026-12220 affects the Yealink SIP-T46U device firmware version 108.86.0.118.

What could be the impact of exploiting CVE-2026-12220?

Exploiting CVE-2026-12220 could allow an attacker to execute arbitrary code on the affected device.