CVE-2026-48490
MediumCVSS 6.9Exploitation Probability (EPSS)
Elevated risk50th percentile - higher than 50% of all known CVEs
Summary
ArduinoCore-avr versions prior to 1.8.8 allow an attacker to trigger a stack-based buffer overflow when concatenating floating-point values of sufficiently large magnitude onto an Arduino String object. Passing values near the extremes of the float or double range to String::concat(float), String::concat(double), String::operator+=(), or the + operator causes dtostrf() to write beyond the stack buffer, leading to memory corruption and denial of service.
Risk Assessment
It can lead to memory corruption and denial of service, and under specific conditions to arbitrary code execution on AVR-based Arduino boards. The risk affects embedded systems using these boards.
Recommendation
Update ArduinoCore-avr to version 1.8.8 or later. Avoid passing extreme floating-point values to String objects.
Related vulnerabilities
- CVE-2026-59105Critical
Jumis (formerly Tildes Jumis) creates a Microsoft SQL Server login named ##Tilde_JumisAdmin## whose password is derived deterministically from a single non-secret input — the SQL Server name (@@servername). The derivation algorithm is hard-coded in the client application and identical across every installation, and it contains a hard-coded secret key. Because the only input (the server name) is not secret, anyone able to reach a Jumis SQL Server can compute the password offline and authenticate.
- CVE-2026-123488Critical
Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element search endpoint because the attribute parameter is concatenated into the query unsanitized and emulated PDO prepares allow stacked statements. Remote attackers can read and write the database, setting the admin flag or overwriting password hashes in the users table to gain administrator access.
- CVE-2026-114630Critical
The ELEX WordPress HelpDesk & Customer Ticketing System plugin is vulnerable to arbitrary file deletion due to insufficient file path validation in the factory_reset function in all versions up to, and including, 3.3.8. Unauthenticated attackers can delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The vulnerability is exploited via a two-step chain: storing an arbitrary ticket_attachment_path value through the public AJAX endpoint, then triggering the factory_reset routine via a GET request.
- CVE-2026-107622Critical
The BuddyForms plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.10.5 via a form-type confusion attack through the bf_post_type parameter. Unauthenticated attackers can insert a rogue BuddyForms form configuration with an attacker-controlled new_user_role value into the live global form registry, then submit a registration through that form to create a new WordPress account with administrator-level privileges. Exploitation requires "Anyone can register" enabled and at least one public BuddyForms form attached to a page.
- CVE-2026-123294Critical
In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow.
- CVE-2026-123279Critical
In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators.
- CVE-2026-88800Critical
The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce. The guard meant to protect roles with assigned users reads a different part of the request than the one selecting what is deleted, allowing unauthenticated attackers to remove any WordPress role including administrator, permanently stripping every user of their capabilities.
- CVE-2026-120844Critical
Incorrect Privilege Assignment vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) through 7.1.3 allows Privilege Escalation.
- CVE-2026-119516Critical
Deserialization of Untrusted Data vulnerability in Radius Booking — Booking Calendar for Appointments & Services through 1.0.20 allows Object Injection.
- CVE-2026-118423Critical
The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.
Original NVD description (English source)
ArduinoCore-avr contains the source code and configuration files of the Arduino AVR Boards platform. A vulnerability in versions prior to 1.8.8 allows an attacker to trigger a stack-based buffer overflow when concatenating floating-point values of sufficiently large magnitude onto an Arduino String object. By passing values near the extremes of the float or double range to `String::concat(float)`, `String::concat(double)`, `String::operator+=()`, or the `+` operator with a float/double operand, `dtostrf()` writes beyond the fixed-size stack buffer, causing memory corruption and denial of service. Under specific conditions, this could enable arbitrary code execution on AVR-based Arduino boards. The fix is included starting from the `1.8.8 `release.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS