CVE-2026-106026

LowCVSS 3.7

Published: 06/10/2026(UTC)Updated: 06/10/2026(UTC)Translated: 06/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.37%

29th percentile - higher than 29% of all known CVEs

Summary

tftp-hpa versions 5.4 through before 6.0 contain an out-of-bounds read vulnerability in rewrite_string() in tftpd/remap.c that walks heap memory during jump label searches. Unauthenticated remote attackers can send read or write requests with filenames matching a remap jump rule to crash the forked in.tftpd request handler.

Risk Assessment

An attacker can remotely crash the TFTP service, leading to denial of service and potential disruption of systems relying on TFTP.

Recommendation

Upgrade tftp-hpa to version 6.0 or later, which includes the fix. If not possible, restrict TFTP access to trusted networks only.

Other vulnerabilities in tftp-hpa

CVE-2026-85234High
A flaw was found in tftp-hpa. When the `in.tftpd` remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the `genmatchstring()` function. This leads to out-of-bounds read/write operations. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request, causing the daemon to crash and resulting in a denial of service.

Original NVD description (English source)

tftp-hpa 5.4 before 6.0 contains an out-of-bounds read vulnerability in rewrite_string() in tftpd/remap.c that walks heap memory during jump label searches. Unauthenticated remote attackers can send read or write requests whose filename matches a remap jump rule to crash the forked in.tftpd request handler.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS