CVE-2026-71265
7.5 HIGHpublic exploit availablePublished 2026-08-05 · Updated 2026-08-10
AI risk analysis
- Summary
- The flaw involves an insecure use of strcpy without length checking, leading to potential stack buffer overflow when processing MOCHAD_RFSEC messages in Domoticz.
- Exploitability
- Exploitation requires specific device types and large input sizes, making it moderately difficult but feasible with the right conditions.
- Blast radius
- If exploited, this could lead to remote code execution or service disruption affecting devices using these specific hardware types.
- Prioritized remediation
- Update Domoticz to a patched version that addresses the buffer overflow vulnerability in MochadTCP::MatchLine handler.
buffer-overflowicsrcestack-overflow
Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
Domoticz's MochadTCP::MatchLine handler for MOCHAD_RFSEC messages (hardware/MochadTCP.cpp) copies network-received data from the up-to-1028-byte m_mochadbuffer into a fixed 50-byte stack buffer tempRFSECbuf using strcpy with no length check, across three separate code branches (DS10A/KR10A/MS10A device types).
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-121
Public exploit & PoC references
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.