CVE-2026-106026CWE-125

CVE-2026-106026

Low · published October 6, 2026

CVSS v3.1
3.7
EPSS
0%
Percentile
29.5
In the wild
Unconfirmed
What it is

tftp-hpa 5.4 before 6.0 contains an out-of-bounds read vulnerability in rewrite_string() in tftpd/remap.c that walks heap memory during jump label searches. Unauthenticated remote attackers can send read or write requests whose filename matches a remap jump rule to crash the forked in.tftpd request handler.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
6.3 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00368 · 29.5th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2026-10-06T18:17Z
References (4)
https://git.kernel.org/pub/scm/network/tftp/tftp-hpa.git/ · [email protected]https://git.kernel.org/pub/scm/network/tftp/tftp-hpa.git/commit/?id=6735086fb6475c3e1f1daf9829836b3d06f14291 · [email protected]https://git.kernel.org/pub/scm/network/tftp/tftp-hpa.git/tree/tftpd/remap.c?h=tftp-hpa-5.4#n762 · [email protected]https://www.vulncheck.com/advisories/tftp-hpa-5.4-before-6.0-out-of-bounds-read-via-tftpd-remap-jump-rule · [email protected]
EPSS history
Timeline
  • 08 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 06 OCT 13:35Z
    tftp-hpa 5.4 before 6.0 Out-of-Bounds Read via tftpd Remap Jump Rule
    cvelistv5