CVE-2026-26399

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-26399
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-26399.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-26399
Downstream
Published
2026-04-20T00:00:00Z
Modified
2026-08-12T03:51:35Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
[none]
Details

A stack-use-after-return issue exists in the Arduino_Core_STM32 library prior to version 1.7.0. The pwm_start() function allocates a TIM_HandleTypeDef structure on the stack and passes its address to HAL initialization routines, where it is stored in a global timer handle registry. After the function returns, interrupt service routines may dereference this dangling pointer, resulting in memory corruption.

Database specific 
{
    "cna_assigner": "mitre",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26399.json"
}
References

Affected packages

Git / github.com/stm32duino/arduino_core_stm32

Affected ranges

Type
GIT
Repo
https://github.com/stm32duino/arduino_core_stm32
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e6a56b3dec4ac1b715ca5eb94f0b51678be9cc60
Database specific
Show details 
{
    "source": "REFERENCES"
}

Affected versions

0.*
0.1.0
0.1.1
0.2.0
0.2.1
1.*
1.0.0
1.0.1
1.1.0
1.1.1
1.2.0
1.3.0
1.4.0
1.5.0
1.6.0
2017.*
2017.11.24
2017.8.31
2017.9.22
2018.*
2018.1.18
STM32-2017.*
STM32-2017.5.12
STM32-2017.6.2
STM32-2017.7.13
STM32-2017.8.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-26399.json"