CVE-2026-19508 in B WebUI
Summary
by MITRE • 08/19/2026
Heap-based buffer overflow in the multipart form-data parser in `jst_post.c` in RDK-B WebUI `rdkb-2025q4-kirkstone.04.10.26` allows a remote unauthenticated attacker to cause memory corruption and denial of service, and potentially execute arbitrary code, via a crafted multipart/form-data request.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability identified in the RDK-B WebUI component specifically within the jst_post.c module represents a critical heap-based buffer overflow condition located in the parser for multipart form-data requests. This flaw arises from insufficient validation of input data lengths during the processing of HTTP POST requests that utilize the multipart/form-data content type, which is commonly used by web interfaces to upload files or submit complex forms. When an attacker constructs a malicious request with carefully crafted payload boundaries and field sizes, they can manipulate internal pointer arithmetic within the parser logic. This manipulation causes the application to write data beyond the allocated bounds of heap-allocated memory buffers. The specific version affected, rdkb-2025q4-kirkstone.04.10.26, indicates that this issue persists in recent iterations of the platform used for residential gateways and set-top boxes, highlighting a persistent gap in input sanitization routines within the web server subsystem.
From a technical perspective, heap-based buffer overflows are particularly dangerous because they allow an attacker to corrupt adjacent memory structures on the heap. In modern operating systems with common exploitation mitigations such as Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP), simply overflowing a buffer may not immediately lead to code execution. However, by carefully crafting the overflow payload, an attacker can overwrite function pointers, exception handling records, or other critical metadata stored in adjacent heap chunks. This corruption can redirect program control flow to arbitrary memory locations where shellcode has been injected via the same request body. The ability to execute arbitrary code remotely without authentication significantly elevates the severity of this vulnerability from a simple denial-of-service issue to a full remote code execution (RCE) vector, potentially granting an attacker complete administrative access to the underlying device operating system.
The operational impact of this vulnerability is severe for network infrastructure and consumer IoT devices running RDK-B. Since the WebUI often serves as the primary management interface for these devices, compromising it allows an unauthenticated remote actor to bypass all security controls that rely on user authentication. An attacker could install persistent backdoors, exfiltrate sensitive configuration data such as Wi-Fi passwords or ISP credentials, pivot into internal network segments by leveraging the device’s position at the network edge, or disrupt service availability through denial-of-service attacks caused by memory corruption crashes. The lack of required authentication means that this vulnerability is easily exploitable in automated scanning campaigns and worm-like propagation scenarios, posing a systemic risk to large deployments of affected hardware across residential broadband networks.
This flaw aligns with Common Weakness Enumeration (CWE) identifiers such as CWE-120 Buffer Copy without Checking Size of Input Classic Buffer Overflow and specifically CWE-122 Heap-based Buffer Overflow when considering the memory allocation context. In terms of offensive security frameworks, this vulnerability facilitates techniques described in MITRE ATT&CK under Remote Code Execution via Web Services (T1505) and potentially Command and Scripting Interpreter if the executed code involves system-level commands. The exploitation path typically falls under Initial Access vectors involving Exploit Public-Facing Application due to its remote nature and lack of authentication requirements.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary solution is for vendors to release a patched version of the rdkb-2025q4-kirkstone series that includes rigorous bounds checking in the jst_post.c multipart parser logic. Developers should implement strict validation of content-length headers, enforce maximum limits on individual field sizes and total request size, and utilize safe string handling libraries or functions that prevent out-of-bounds writes. For organizations unable to immediately patch their devices, network-level mitigations such as Web Application Firewalls (WAF) can be configured to inspect incoming multipart requests for anomalous patterns, oversized payloads, or malformed boundary markers. Additionally, enabling strict Content-Type validation and restricting the web interface to trusted IP ranges where possible can reduce the attack surface exposed to unauthenticated remote actors until a permanent software fix is deployed.