Broadcom Fabric OS up to 10.0.0 Security Library stack-based overflow

Summaryinfo

A vulnerability has been found in Broadcom Fabric OS up to 10.0.0 and classified as problematic. This impacts an unknown function of the component Security Library. Performing a manipulation results in stack-based overflow. This vulnerability is known as CVE-2026-87676. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as problematic has been found in Broadcom Fabric OS up to 10.0.0. This affects an unknown part of the component Security Library. The manipulation with an unknown input leads to a stack-based overflow vulnerability. CWE is classifying the issue as CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). This is going to have an impact on availability. The summary by CVE is:

A stack-based buffer overflow vulnerability exists in the security library component of Brocade Fabric OS versions before 10.0.1. When parsing uploaded X.509 PEM certificates for management display, the system improperly validates the length of the Authority Key Identifier (AKI) extension before copying string tokens into an internal memory buffer. An authenticated user with administrative privileges to import custom certificates can supply a certificate containing an intentionally oversized AKI extension. When the system processes or renders the certificate attributes, this can trigger a stack memory corruption leading to a denial-of-service (DoS) condition by crashing the management daemon.

It is possible to read the advisory at support.broadcom.com. This vulnerability is uniquely identified as CVE-2026-87676 since 09/09/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. The exploitation requires an enhanced level of successful authentication. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 10.0.1 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Broadcom

Name

• Fabric OS

Version

• 10.0

License

• commercial

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion