CVE-2026-10664
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A buffer overflow vulnerability was found in the nRF70 Wi-Fi driver's power-save event handler. The function copies TWT entries from an event into a fixed-size array without validating the entry count, leading to an out-of-bounds write.
Risk Assessment
An attacker could exploit this vulnerability to write beyond the allocated memory buffer, potentially causing a system crash or arbitrary code execution in kernel context.
Recommendation
Immediately update the nRF70 driver to a version containing the fix that rejects events with an invalid number of TWT entries.
Related vulnerabilities
- CVE-2026-124079Critical
rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 contain a deserialization of untrusted data vulnerability. An unauthenticated attacker can push a crafted serialized job onto the Redis-backed Laravel Horizon queue, leading to arbitrary code execution via the App\Jobs\TaskDownloadRun class and the bundled laravel/tinker package.
- CVE-2026-110469Critical
WidzialniCMS is vulnerable to unrestricted file upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any location on the server, leading to remote code execution.
- CVE-2026-110468Critical
WidzialniCMS is vulnerable to unrestricted file upload in the /panel/controllers/save_photo.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the currentpath parameter, an unauthenticated attacker can upload arbitrary files to any location on the server, leading to remote code execution.
- CVE-2026-118462Critical
Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution.
- CVE-2026-115252Critical
The Confection WordPress Cable plugin from 0.4.0 to 0.4.7 does not perform capability or nonce checks before saving its settings and writes one of them unmodified into a standalone PHP file that it then serves. This allows unauthenticated users to execute arbitrary PHP code on the server.
- CVE-2026-124585Critical
A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP devices within the web administration interface. The add_expmac function in var/html/webserver mishandles the mac argument, resulting in OS command injection. The attack can be performed remotely and a public exploit is available.
- CVE-2026-123870Critical
The otterdog webapp evaluates a format-string built from the incoming GitHub webhook JSON body using Python's eval(). When GITHUB_WEBHOOK_SECRET is unset or empty (default None), the HMAC signature check is skipped entirely, allowing an unauthenticated network client to reach the eval() sink with attacker-controlled input and execute arbitrary Python on the host.
- CVE-2026-124580Critical
A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP version 1.0 B-MB3W202-210825-r11775, affecting the handle_wechat_cn_wifi function in var/html/webserver within the Weixin Auth Endpoint component. Manipulation of the extend argument results in OS command injection. The attack can be executed remotely and the exploit has been made public.
- CVE-2026-124577Critical
A weakness has been identified in Intelbras SG 2404 PoE L2+ versions 1.00.70 and 1.00.72, affecting an unknown function in the /EXCU_SHELL file within the Web Management Interface component. Manipulation can lead to improper authentication. The attack can be launched remotely and the exploit has been made publicly available.
- CVE-2026-113364Critical
Buffer overflow in the data receiving process in NEC WebSAM WinShare versions 7.5.0 and earlier, 7.6.0, and 7.7.0 through 7.7.2 on Windows allows a remote unauthenticated attacker to execute arbitrary code with SYSTEM privileges via a crafted packet with a malformed data size value in the protocol header.
Original NVD description (English source)
The nRF70 Wi-Fi driver's power-save event handler nrf_wifi_event_proc_get_power_save_info() in drivers/wifi/nrf_wifi/src/wifi_mgmt.c copied TWT (Target Wake Time) flow entries from an nrf_wifi_umac_event_power_save_info event into the fixed-size twt_flows[WIFI_MAX_TWT_FLOWS] (8-element) array of a caller-supplied struct wifi_ps_config, looping over event-provided num_twt_flows without validating it against WIFI_MAX_TWT_FLOWS or checking event_len. When num_twt_flows exceeds 8, the handler writes past the destination array (which is typically on the caller's stack, e.g. the wifi ps shell command) -- an out-of-bounds write of ~40-byte TWT entries -- and reads twt_flow_info[i] past the event buffer. The event is delivered by the nRF70 co-processor firmware in response to a host-initiated power-save GET, so reaching the overflow requires the firmware to emit a malformed or out-of-range event; the trust boundary is host-to-trusted-coprocessor rather than a direct remote-AP write, with over-the-air influence on the flow count being indirect and bounded by the 3-bit TWT flow-id space. Affected: builds with CONFIG_NRF70_STA_MODE on releases through v4.4.0. The fix rejects events with num_twt_flows > WIFI_MAX_TWT_FLOWS or with event_len shorter than the claimed entries, and adds a NULL check on the caller buffer.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS