Stack-Use-After-Return Vulnerability in Arduino_Core_STM32 Library
CVE-2026-26399

5.3MEDIUM

Key Information:

Vendor

Arduino

Status
Arduino_Core_STM32
Vendor
CVE Published:
20 April 2026

What is CVE-2026-26399?

A vulnerability exists in the Arduino_Core_STM32 library, where the pwm_start() function allocates a TIM_HandleTypeDef structure on the stack. This structure's address is passed to HAL initialization routines, subsequently stored in a global timer handle registry. Upon return from the function, the stack memory can be dereferenced by interrupt service routines, leading to potential memory corruption. Updating to version 1.7.0 or later is recommended to mitigate this issue.

References

https://github.com/stm32duino/Arduino_Core_STM32/releases...
https://github.com/Acen28/CVE-2026-26399-Disclosure

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.