CVE-2026-13197CWE-362

CVE-2026-13197

published August 14, 2026

CVSS
7.3
EPSS
0%
Percentile
2.1
In the wild
Unconfirmed
What it is

Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the configuration and process-image management functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker to trigger use-after-free and invalid pointer dereferences on kernel configuration objects, resulting in kernel memory corruption and denial of service, by issuing concurrent crafted requests through the piControl character device.

The record
Technical detail
CVSS
7.3 · NONE
CVSS v4.0
7.3 · CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00127 · 2.1th percentile
Weakness
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Published
2026-08-14T20:16Z
References (1)
https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2026-13197 · [email protected]
EPSS history
Timeline
  • 14 AUG 15:01Z
    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in KUNBUS piControl
    cvelistv5