CVE-2026-18585CWE-119CWE-122

CVE-2026-18585

Medium · published August 3, 2026

CVSS v3.1
4.3
EPSS
1%
Percentile
42.6
In the wild
Unconfirmed
What it is

A vulnerability was detected in GL.iNet MT3000, MT6000, BE9300, BE3600, MT3600BE, E5800, BE6500, MT5000, X3000, XE3000 and MT2500 up to 20260707. The affected element is the function nas-web.get_file_list of the component APPS-NAS Module. Performing a manipulation results in heap-based buffer overflow. The attack may be initiated remotely. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00509 · 42.6th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-122 · Heap-based Buffer Overflow
Published
2026-08-03T10:16Z
References (5)
https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Heap%20buffer%20overflow%20in%20nas-web.get_file_list%20leading%20to%20authenticated%20denial%20of%20service.md · [email protected]https://vuldb.com/cve/CVE-2026-18585 · [email protected]https://vuldb.com/submit/849290 · [email protected]https://vuldb.com/vuln/385414 · [email protected]https://vuldb.com/vuln/385414/cti · [email protected]
EPSS history
Timeline
  • 03 AUG 05:15Z
    GL.iNet MT2500 APPS-NAS nas-web.get_file_list heap-based overflow
    cvelistv5