CVE-2026-87679CWE-122

CVE-2026-87679

High · published October 8, 2026

CVSS v3.1
7.2
EPSS
0%
Percentile
28.4
In the wild
Unconfirmed
What it is

When Brocade Fabric OS versions before 10.0.1 processes trunk configuration operations, the application parses user-supplied list strings into dynamically allocated heap arrays without enforcing boundary checks on the maximum allowable number of elements. An authenticated administrator can exploit this vulnerability via crafted REST API requests containing an excessive number of list delimiters, causing heap corruption that can result in service crash or arbitrary code execution.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.5 · CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00358 · 28.4th percentile
Weakness
CWE-122 · Heap-based Buffer Overflow
Published
2026-10-08T05:16Z
Affected products (1)
ProductVersionsFixed in
broadcom/fabric_operating_system< 10.0.110.0.1
References (1)
https://support.broadcom.com/external/content/SecurityAdvisories/0/39073 · [email protected]
EPSS history
Timeline
  • 09 OCT 03:32Z
    EPSS moved — → 0%
    epss
  • 08 OCT 00:44Z
    When Brocade Fabric OS versions before 10.0.1 processes trunk configuration operations, the application parses user-supplied list strings into dynamically…
    cvelistv5
  • 08 OCT 00:44Z
    When Brocade Fabric OS versions before 10.0.1 processes trunk configuration operations, the application parses user-supplied list strings into dynamically…
    cvelistv5