CVE-2026-35717: Buffer Overflow
A stack-based buffer overflow in the exportlanguage.cgi binary in VIVOTEK FD8136 firmware FD8136-VVTK-0300a allows authenticated remote attackers to execute arbitrary code as root via a crafted POST request to the /cgi-bin/admin/exportlanguage.cgi endpoint. The handler passes the attacker-controlled Content-Length value directly to fread() as the read size into a fixed-size 0x60-byte stack buffer, overwriting the saved link register. The binary is compiled without stack canaries.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35717?
CVE-2026-35717 has a medium severity rating of 6.3 based on CVSS 3.1.
How do I fix CVE-2026-35717?
To mitigate CVE-2026-35717, update the Vivotek FD8136 firmware to the latest version provided by the vendor.
What type of vulnerability is CVE-2026-35717?
CVE-2026-35717 is a stack-based buffer overflow vulnerability.
Who can exploit CVE-2026-35717?
CVE-2026-35717 can be exploited by authenticated remote attackers with access to the /cgi-bin/admin/export_language.cgi endpoint.
What could an attacker achieve by exploiting CVE-2026-35717?
Exploiting CVE-2026-35717 allows an attacker to execute arbitrary code as root on the affected device.