CVE-2026-48490: ArduinoCore-AVR: Stack-Based Buffer Overflow in String float/double concatenation handler
ArduinoCore-avr contains the source code and configuration files of the Arduino AVR Boards platform. A vulnerability in versions prior to 1.8.8 allows an attacker to trigger a stack-based buffer overflow when concatenating floating-point values of sufficiently large magnitude onto an Arduino String object. By passing values near the extremes of the float or double range to String::concat(float), String::concat(double), String::operator+=(), or the + operator with a float/double operand, dtostrf() writes beyond the fixed-size stack buffer, causing memory corruption and denial of service. Under specific conditions, this could enable arbitrary code execution on AVR-based Arduino boards. The fix is included starting from the 1.8.8 release.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ArduinoCore-AVRto a version that resolves this vulnerability.Fixed in 1.8.8
Event History
Frequently Asked Questions
Which deployments are affected?
AVR-based Arduino boards using ArduinoCore-AVR versions earlier than 1.8.8 are affected when their sketches concatenate floating-point values onto Arduino String objects.
What input or code path is needed to trigger the issue?
The vulnerable path is reached when a float or double with sufficiently large magnitude, including values near the type's extremes, is concatenated through String::concat(float), String::concat(double), String::operator+=(), or the + operator with a float or double operand.
What is the impact of successful exploitation?
The overflow corrupts memory and can cause denial of service. Under specific conditions, it could also enable arbitrary code execution on affected AVR-based boards.
What should teams do to remediate the issue?
Update ArduinoCore-AVR to version 1.8.8 or later, where the fix is included. Until updating, avoid concatenating untrusted or extreme-magnitude float and double values onto Arduino String objects.