CVE-2026-71265: Domoticz MochadTCP Stack Buffer Overflow via MOCHAD_RFSEC strcpy()
Published Aug 5, 2026
·Updated
Domoticz's MochadTCP::MatchLine handler for MOCHADRFSEC messages (hardware/MochadTCP.cpp) copies network-received data from the up-to-1028-byte mmochadbuffer into a fixed 50-byte stack buffer tempRFSECbuf using strcpy with no length check, across three separate code branches (DS10A/KR10A/MS10A device types).
Affected Software
1 affected component
Domoticz
Event History
Aug 5, 2026
CVE Published
via MITRE·12:26 PM
Data Sourced
via MITRE·12:26 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·01:24 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-71265?
CVE-2026-71265 has a high severity score of 7.5.
2
How do I fix CVE-2026-71265?
To fix CVE-2026-71265, update to the latest version of Domoticz where the buffer overflow vulnerability has been addressed.
3
What kind of vulnerability is CVE-2026-71265?
CVE-2026-71265 is a stack buffer overflow vulnerability in the Domoticz MochadTCP handler.
4
What are the potential impacts of CVE-2026-71265?
CVE-2026-71265 can lead to remote code execution or system crashes due to the buffer overflow.
5
Which component is affected by CVE-2026-71265?
CVE-2026-71265 affects the MochadTCP::MatchLine() function in the Domoticz software.