CVE-2026-18269: (Pwn2Own) Kenwood DNR1007XR tchdr_bytestream_read Out-Of-Bounds Write Code Execution Vulnerability
Kenwood DNR1007XR tchdrbytestreamread Out-Of-Bounds Write Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DNR1007XR devices. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the tchdrbytestreamread function. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-28980.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch ZDI-CAN-28980 - Compensating control
Mitigate physically present exploitation of Kenwood DNR1007XR by restricting physical access to the device (and any relevant ports/interfaces) to authorized personnel only.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be physically present at an affected Kenwood DNR1007XR device. No authentication is required.
What level of access could successful exploitation provide?
Successful exploitation can allow arbitrary code execution in the context of root, with high confidentiality, integrity, and availability impact.
What input condition triggers the vulnerability?
The issue is in tchdr_bytestream_read, where insufficient validation of attacker-supplied data can cause a write past the end of an allocated buffer.