CVE-2026-43856
8.6HighPublished 20 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- —
Impact
Remote authenticated attackers with high privileges can execute arbitrary code by supplying a path longer than 1024 bytes. Network access to the vulnerable service and valid high-privilege credentials are required.
Root cause
A stack-based buffer overflow in the FileProcess::CheckDir function triggered by overly long path inputs.
Affected systems
Advantech products (specific product and versions not listed — check the vendor advisory).
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Consult the Advantech security advisory for the target fixed software or firmware version. As an interim workaround, restrict network access to the management interface and limit administrative account access.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated attacker to achieve arbitrary code execution via a path longer than 1024 bytes.