Stack Buffer Overflow in INDI indiserver Affects Instrument Neutral Distributed Interface

CVE-2026-71979

What is CVE-2026-71979?

The INDI indiserver through version 2.2.4.2 contains a significant stack buffer overflow vulnerability. This flaw can be exploited by unauthenticated remote attackers who send malformed XML containing mismatched tags with lengths that exceed 1024 bytes. By doing so, attackers can trigger an unbounded sprintf() write into a fixed 1024-byte stack buffer, causing the daemon to crash and terminating all active client and driver sessions. To mitigate this, users are encouraged to update to the patched version available in commit 96bbd7f.

References