indilib indi up to 2.2.4.2 Message Queue MsgQueue.cpp sprintf stack-based overflow

Summaryinfo

A vulnerability described as critical has been identified in indilib indi up to 2.2.4.2. Affected is the function sprintf of the file MsgQueue.cpp of the component Message Queue. The manipulation results in stack-based overflow. This vulnerability was named CVE-2026-71979. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as critical, was found in indilib indi up to 2.2.4.2. Affected is the function sprintf of the file MsgQueue.cpp of the component Message Queue. The manipulation with an unknown input leads to a stack-based overflow vulnerability. CWE is classifying the issue as CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). This is going to have an impact on availability. CVE summarizes:

INDI (Instrument Neutral Distributed Interface) indiserver through 2.2.4.2, fixed in commit 96bbd7f, contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to crash the daemon by sending malformed XML with mismatched tags whose names exceed 1024 bytes. Attackers can send a single TCP packet on port 7624 with mismatched XML tags to trigger an unbounded sprintf() write into a fixed 1024-byte stack buffer in MsgQueue.cpp, terminating the daemon and disrupting all active client and driver sessions.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-71979 since 08/08/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available.

Applying the patch 96bbd7f564bbb128a129019e44eadd40dd49cff9 is able to eliminate this problem.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• indilib

Name

• indi

Version

• 2.2.4.0
• 2.2.4.1
• 2.2.4.2

Website

• Product: https://github.com/indilib/indi/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion