CVE-2026-103432 PUBLISHED

Assigner: mitre
Reserved: 30.09.2026 Published: 30.09.2026 Updated: 30.09.2026

apcupsd through 3.14.14 has an sscanf stack-based buffer overflow in getupsvar() in src/cgi/upsfetch.c (used by upsstats.cgi, multimon.cgi, and upsfstats.cgi), a related issue to CVE-2026-15544.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 8.1

Attack Vector	Network	Scope	Unchanged
Attack Complexity	High	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	apcupsd
Product	apcupsd
Versions	Default: unknown affected from 0 to 3.14.14 (incl.)

References

https://bugzilla.redhat.com/show_bug.cgi?id=2493140
https://github.com/therealbstern/apcupsd/blob/224d19d5faa508d04267f6135fe53d50800550de/src/cgi/upsfetch.c#L240
https://sourceforge.net/projects/apcupsd/

Problem Types

CWE-121 Stack-based Buffer Overflow CWE