{"id":"CVE-2026-71979","title":"INDI (Instrument Neutral Distributed Interface) indiserver through 2.2.4.2, fixed in commit 96bbd7f, contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to crash the daemon by sending malformed XML…","summary":"INDI (Instrument Neutral Distributed Interface) indiserver through 2.2.4.2, fixed in commit 96bbd7f, contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to crash the daemon by sending malformed XML…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-121"],"published":"2026-08-17","updated":"2026-09-24","sourceUpdated":"2026-09-24T20:06:30.133","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-71979","references":[{"url":"https://github.com/indilib/indi/commit/96bbd7f564bbb128a129019e44eadd40dd49cff9","label":"disclosure@vulncheck.com"},{"url":"https://github.com/indilib/indi/issues/2472","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/indi-indiserver-stack-buffer-overflow-via-xml-tag-parsing","label":"disclosure@vulncheck.com"},{"url":"https://github.com/indilib/indi/issues/2472","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd"],"epss":0.00848,"epssPercentile":0.56261,"ingestedAt":"2026-09-24T20:51:40.204Z","slug":"CVE-2026-71979","body":"## Overview\n\nINDI (Instrument Neutral Distributed Interface) indiserver through 2.2.4.2, fixed in commit 96bbd7f, contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to crash the daemon by sending malformed XML with mismatched tags whose names exceed 1024 bytes. Attackers can send a single TCP packet on port 7624 with mismatched XML tags to trigger an unbounded sprintf() write into a fixed 1024-byte stack buffer in MsgQueue.cpp, terminating the daemon and disrupting all active client and driver sessions.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}