What’s Vulnerable › Vulnerabilities

CVE-2025-26386: Stack-based Buffer Overflow in Johnson Controls iSTAR Configuration Utility (ICU) tool

• Severity: high (CVSS 7.1 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-28 · updated 2026-06-17
• Weakness: CWE-121

Description

Johnson Controls iSTAR Configuration Utility (ICU) has Stack-based Buffer Overflow vulnerability. This issue affects iSTAR Configuration Utility (ICU) version 6.9.7 and prior. Successful exploitation of this vulnerability could result in failure within the operating system of the machine hosting the ICU tool.

Affected products

• Johnson Controls iSTAR Configuration Utility (ICU): through iSTAR Configuration Utility (ICU) tool version 6.9.7

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-26-022-04
• https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories

Get alerted when CVE-2025-26386 or the next vulnerability affects your stack