CVE-2026-103436CWE-457

CVE-2026-103436

Low · published September 30, 2026

CVSS v3.1
3.7
EPSS
0%
Percentile
20.7
In the wild
Unconfirmed
What it is

apcupsd through 3.14.14 discloses uninitialized stack memory in getupsvar() in src/cgi/upsfetch.c (used by upsstats.cgi, multimon.cgi, and upsfstats.cgi. On the single-field path, when the matched STATUS line has fewer than three whitespace-separated tokens, sscanf("%*s %*s %s", answer) performs no assignment but the function returns success, and thus the caller prints the uninitialized destination buffer into the HTTP response.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00293 · 20.7th percentile
Weakness
CWE-457 · Use of Uninitialized Variable
Published
2026-09-30T20:17Z
References (3)
https://bugzilla.redhat.com/show_bug.cgi?id=2493140 · [email protected]https://github.com/therealbstern/apcupsd/blob/224d19d5faa508d04267f6135fe53d50800550de/src/cgi/upsfetch.c#L240 · [email protected]https://sourceforge.net/projects/apcupsd/ · [email protected]
EPSS history
Timeline
  • 02 OCT 03:41Z
    EPSS moved — → 0%
    epss
  • 30 SEP 15:38Z
    apcupsd through 3.14.14 discloses uninitialized stack memory in getupsvar() in src/cgi/upsfetch.c (used by upsstats.cgi, multimon.cgi, and upsfstats.cgi
    cvelistv5