What’s Vulnerable › Vulnerabilities

CVE-2026-82478: NASA Trick TCP Socket JSONVariableServerThread.cpp parse_request stack-based overflow

• Severity: high (CVSS 7.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-30 · updated 2026-08-31
• Weakness: CWE-119

Description

A vulnerability was determined in NASA Trick 19.6.0. This issue affects the function JSONVariableServerThread::parse_request of the file trick_source/sim_services/JSONVariableServer/JSONVariableServerThread.cpp of the component TCP Socket Handler. This manipulation causes stack-based buffer overflow. The attack is possible to be carried out remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

• NASA Trick: 19.6.0

References

• https://app.notion.com/p/Stack-based-Buffer-Overflow-in-NASA-Trick-JSONVariableServer-via-Unbounded-sscanf-on-Network-Receive-39cbd773e51180e1917cd717b90b8bc8?source=copy_link
• https://vuldb.com/cve/CVE-2026-82478
• https://vuldb.com/submit/888016
• https://vuldb.com/vuln/397028
• https://vuldb.com/vuln/397028/cti

Get alerted when CVE-2026-82478 or the next vulnerability affects your stack