CVE-2026-38821

7.1 highEPSS 0.3%

High (7.1). EPSS 0.3% chance of exploitation in the next 30 days.

A heap-based buffer overflow vulnerability exists in openNDS before 11.0.0 that allows an unauthenticated attacker on the captive portal network to crash the openNDS daemon (denial of service) and potentially achieve remote code execution. This is in http_microhttpd.c.

Severity

CVSS 3.1

7.1 high

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 23% of CVEs (scores of 2026-11-01)
CWE: CWE-122
Published: 2026-08-28
Modified: 2026-09-09
Record from: the NVD, synced 2026-10-19

References

https://github.com/openNDS/openNDS/commit/3b5f7ef40cd048826d3c4a16f61a73a1768fd5a9

Check your stack JSON