CVEFinder.io

CVE-2026-49420

⚠️ high
🔍 Scan for this CVE
Summary

The RTSP handler in libalias rewrote outgoing packets into a fixed-length stack buffer without checking whether the rewritten data fit in the buffer, or whether the result fit back in the original packet. A host sending crafted RTSP traffic from inside a NAT gateway using libalias can overflow a stack buffer, potentially achieving remote code execution in the kernel (when using ipfw(4) NAT) or in the natd(8) process (which generally runs as the root user).

CVSS Score
8.8
High
EPSS Score
0.3
Exploit Probability
Published Date
2026-08-19
First Seen: 2026-08-20
📊 Relative Risk Intelligence

This CVE is High Risk - more severe than 80.8% of all 360,673 vulnerabilities in our database.

#69,256
Top 25% most severe
Severity Percentile
🎯 CISA SSVC Assessment Updated: Aug 19, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Total
Complete system compromise possible
🏆 Discovered By
Atuin - Automated Vulnerability Discovery Engine, Tianchu Chen of Tencent Xuanwu Lab UC Berkeley Antiproof Stanislav Fort of Aisle Research
SSVC data provided by CISA
Last Modified 2026-09-01
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE IDs (Weakness Types)

📦 Affected Products 4

🔗 References 1

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-58095 ⚠️ high 8.8 0.6 mp_Enddisc() used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a... 2026-08-26
CVE-2026-58096 ⚠️ high 8.8 0.6 LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by... 2026-08-26
CVE-2026-58097 ⚠️ high 7.8 0.2 mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ... 2026-08-26
CVE-2026-49415 ⚠️ high 8.8 0.2 During execve(2) of a SUID binary, the new virtual address space is installed before the process credentials are updated... 2026-08-19
CVE-2026-49418 ⚠️ high 8.8 0.3 When msync(MS_INVALIDATE) is called on a mapping of an unmanaged device object, the physical pages in the mapping range ... 2026-08-19
CVE-2026-49419 ⚠️ high 8.8 0.3 When the JAIL_AT_DESC flag is specified, kern_jail_set() and kern_jail_get() released the reference to the caller's curr... 2026-08-19
These CVEs affect the same products