CVE-2026-38821CWE-122

CVE-2026-38821

High · published August 28, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
22.3
In the wild
Unconfirmed
What it is

A heap-based buffer overflow vulnerability exists in openNDS before 11.0.0 that allows an unauthenticated attacker on the captive portal network to crash the openNDS daemon (denial of service) and potentially achieve remote code execution. This is in http_microhttpd.c.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00307 · 22.3th percentile
Weakness
CWE-122 · Heap-based Buffer Overflow
Published
2026-08-28T06:16Z
References (1)
https://github.com/openNDS/openNDS/commit/3b5f7ef40cd048826d3c4a16f61a73a1768fd5a9 · [email protected]
EPSS history
Timeline
  • 28 AUG 00:10Z
    A heap-based buffer overflow vulnerability exists in openNDS before 11.0.0 that allows an unauthenticated attacker on the captive portal network to crash the…
    cvelistv5