CVE-2026-19508: RDK WebUI heap-based buffer overflow vulnerability
Heap-based buffer overflow in the multipart form-data parser in jstpost.c in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows a remote unauthenticated attacker to cause memory corruption and denial of service, and potentially execute arbitrary code, via a crafted multipart/form-data request.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote unauthenticated attacker can target the affected WebUI by sending a crafted multipart/form-data request. No credentials are required according to the available information.
What is the potential impact?
Successful exploitation can cause memory corruption and denial of service. The issue may also permit arbitrary code execution.
How can I determine whether my deployment is affected?
Verify whether the deployed RDK-B WebUI version is rdkb-2025q4-kirkstone.04.10.26. The vulnerability is in the multipart form-data parser in jst_post.c.