CVE-2026-71979 PUBLISHED

INDI indiserver 2.2.4.2 Stack Buffer Overflow via XML Tag Parsing

Assigner: VulnCheck
Reserved: 08.08.2026 Published: 17.08.2026 Updated: 17.08.2026

INDI (Instrument Neutral Distributed Interface) indiserver through 2.2.4.2, fixed in commit 96bbd7f, contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to crash the daemon by sending malformed XML with mismatched tags whose names exceed 1024 bytes. Attackers can send a single TCP packet on port 7624 with mismatched XML tags to trigger an unbounded sprintf() write into a fixed 1024-byte stack buffer in MsgQueue.cpp, terminating the daemon and disrupting all active client and driver sessions.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS Score: 8.7

Product Status

Vendor indilib
Product indi
Versions Default: affected
  • affected from 0 to 2.2.4.2 (incl.)
  • Version 96bbd7f564bbb128a129019e44eadd40dd49cff9 is unaffected

Credits

  • Fatullayev Asadbek finder

References

Problem Types

  • Stack-based Buffer Overflow CWE