CVE-2026-71979: INDI indiserver 2.2.4.2 Stack Buffer Overflow via XML Tag Parsing
INDI (Instrument Neutral Distributed Interface) indiserver through 2.2.4.2, fixed in commit 96bbd7f, contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to crash the daemon by sending malformed XML with mismatched tags whose names exceed 1024 bytes. Attackers can send a single TCP packet on port 7624 with mismatched XML tags to trigger an unbounded sprintf() write into a fixed 1024-byte stack buffer in MsgQueue.cpp, terminating the daemon and disrupting all active client and driver sessions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
INDI indiserverto a version that resolves this vulnerability.Fixed in 2.2.4.2Patch 96bbd7f
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71979?
The severity of CVE-2026-71979 is classified as high, with a CVSS score of 7.5.
How do I fix CVE-2026-71979?
To fix CVE-2026-71979, update to the latest version of the INDI indiserver that addresses the buffer overflow vulnerability.
What type of vulnerability is CVE-2026-71979?
CVE-2026-71979 is a stack buffer overflow vulnerability caused by improper XML tag parsing.
Who is affected by CVE-2026-71979?
Users of INDI indiserver version 2.2.4.2 are affected by CVE-2026-71979 due to the vulnerability in the software.
What could an attacker do with CVE-2026-71979?
An attacker exploiting CVE-2026-71979 could crash the INDI indiserver daemon by sending specially crafted XML with mismatched tags.