Stack-based Buffer Overflow in Arduino AVR Boards by Arduino

CVE-2026-48490

What is CVE-2026-48490?

A vulnerability exists in Arduino AVR Boards versions before 1.8.8, which allows attackers to exploit a stack-based buffer overflow. This occurs when large floating-point values are concatenated onto an Arduino String object via methods such as String::concat(float), String::concat(double), or using the '+' operator. The function dtostrf() can overflow the fixed-size stack buffer, leading to memory corruption and potential denial of service. In certain scenarios, this vulnerability could be leveraged to execute arbitrary code on AVR-based Arduino hardware. To mitigate the risk, users are encouraged to update to version 1.8.8 or later.

References