CVE-2026-54212 PUBLISHED

TeamDavid: Buffer Overflow in JSON-parsing

Assigner: NCSC.ch
Reserved: 12.06.2026 Published: 07.08.2026 Updated: 07.08.2026

Tobit Laboratories AG TeamDavid's Webbox application implements an API endpoint that is vulnerable to a buffer overflow condition. By submitting a specially crafted JSON body, such as one that is at least 8 characters long and begins with a number, an unauthenticated attacker can cause the server to crash, resulting in denial of service. Depending on the stack state or if a stack canary can be disclosed through another vulnerability, this buffer overflow could potentially lead to remote code execution and full compromise of the server. This issue affects TeamDavid through Rollout 524.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVSS Score: 9.5

Product Status

Vendor Tobit Laboratories AG
Product TeamDavid
Versions Default: unaffected
  • affected from 0 to Rollout 524 (incl.)

Credits

  • Lucas Dodgson of InfoGuard Labs finder

References

Problem Types

  • CWE-787 Out-of-bounds write CWE