CVE-2026-13198

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in KUNBUS piControl

Assigner: Nozomi
Reserved: 24.06.2026 Published: 14.08.2026 Updated: 14.08.2026

Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the event notification functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker to corrupt kernel heap and event-list state and disclose a small amount of adjacent kernel memory, resulting in kernel memory corruption and denial of service, by issuing concurrent crafted requests from multiple threads through the piControl character device.

Metrics

CVSS Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 5.9

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Local	Confidentiality	Low	Confidentiality	None
Attack Complexity	High	Integrity	High	Integrity	None
Attack Requirements	Present	Availability	High	Availability	None
Privileges Required	Low
User Interaction	None

CVSS 4.0

Product Status

Vendor	KUNBUS
Product	piControl
Versions	Default: unaffected affected from 0 to 2.6.2 (incl.)

Vendor

KUNBUS

Product

piControl

Versions

Default: unaffected

affected from 0 to 2.6.2 (incl.)

Credits

Gabriele Quagliarella at Nozomi Networks finder

References

Problem Types

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE

Impacts

CAPEC-26