CVE-2026-71979
- Source
- https://cve.org/CVERecord?id=CVE-2026-71979
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71979.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-71979
- Published
- 2026-08-17T17:40:38Z
- Modified
- 2026-08-19T12:09:58Z
- Severity
-
- 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- INDI indiserver 2.2.4.2 Stack Buffer Overflow via XML Tag Parsing
- Details
-
INDI (Instrument Neutral Distributed Interface) indiserver through 2.2.4.2, fixed in commit 96bbd7f, contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to crash the daemon by sending malformed XML with mismatched tags whose names exceed 1024 bytes. Attackers can send a single TCP packet on port 7624 with mismatched XML tags to trigger an unbounded sprintf() write into a fixed 1024-byte stack buffer in MsgQueue.cpp, terminating the daemon and disrupting all active client and driver sessions.
- Database specific
{ "cna_assigner": "VulnCheck", "cwe_ids": [ "CWE-121" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71979.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71979.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-71979
- https://www.vulncheck.com/advisories/indi-indiserver-stack-buffer-overflow-via-xml-tag-parsing
- https://github.com/indilib/indi/issues/2472
- https://github.com/indilib/indi/commit/96bbd7f564bbb128a129019e44eadd40dd49cff9
- https://github.com/indilib/indi
Affected packages
Git / github.com/indilib/indi
Affected versions
v1.*
v1.3
v1.3.1
v1.4.0
v1.4.1
v1.5.0
v1.6.0
v1.6.1
v1.6.2
v1.7.0
v1.7.1
v1.7.2
v1.7.4
v1.7.5
v1.7.6
v1.7.7
v1.7.8
v1.7.9
v1.8.0
v1.8.1
v1.8.2
v1.8.3
v1.8.4
v1.8.5
v1.8.6
v1.8.7
v1.8.8
v1.8.9
v1.9.0
v1.9.1
v1.9.2
v1.9.3
v1.9.4
v1.9.5
v1.9.5.1
v1.9.6
v1.9.7
v1.9.8
v1.9.9
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1.0
v2.1.1
v2.1.2
v2.1.2.1
v2.1.3
v2.1.4
v2.1.5
v2.1.5.1
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.1.1
v2.2.2
v2.2.3
v2.2.3.1
v2.2.4
v2.2.4.1
v2.2.4.2
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71979.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "10990697943017443259861861050276970293",
"length": 1993
},
"id": "CVE-2026-71979-12515fcb",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/indilib/indi/commit/96bbd7f564bbb128a129019e44eadd40dd49cff9",
"target": {
"file": "libs/indibase/inditelescope.cpp",
"function": "Telescope::LoadParkXML"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"319041238189782774522330056463670709412",
"96063889084206990237359990466843556998",
"297128971867381466326698062276138549280",
"294033986388081462256875211404954382565"
],
"threshold": 0.9
},
"id": "CVE-2026-71979-2c59e309",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/indilib/indi/commit/96bbd7f564bbb128a129019e44eadd40dd49cff9",
"target": {
"file": "libs/indibase/indidome.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "155685914916968717267873109151431282808",
"length": 4829
},
"id": "CVE-2026-71979-2edb7a94",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/indilib/indi/commit/96bbd7f564bbb128a129019e44eadd40dd49cff9",
"target": {
"file": "libs/indicore/lilxml.cpp",
"function": "oneXMLchar"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "22267238766500384926000323245869199363",
"length": 255
},
"id": "CVE-2026-71979-3effa46e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/indilib/indi/commit/96bbd7f564bbb128a129019e44eadd40dd49cff9",
"target": {
"file": "libs/indicore/lilxml.cpp",
"function": "cloneXMLEle"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"107508629376373447128715473912245171877",
"288939832757333225793513060340203188767",
"240007913939940074329202157979235636037",
"314418393188999531654261704499742423320",
"43633568736555986995897779996813130062",
"288939832757333225793513060340203188767",
"213145758488268544476584760809979205052",
"79737693894224460224526363963158077688",
"47605006035810147394656791230862934197",
"309206436070477855299911333678871124870",
"204675492082532986768262124963169232593",
"214220367734468884254888712366941324546",
"158579352426125529293032918490011702709",
"99419261954272548147519034134653978963",
"3649801687310112738088225040992900520",
"257560874929595941358931385696433085121",
"280977901677958164545039858262305883483",
"21123886573615404250311765813753768762",
"302690436975271081037693163829362300458",
"104355895789623752621948381832017616371",
"22983183081564123253933336022643120219",
"299309699040094760775840933433603413356",
"178663080482417411897202315337242644416",
"313969404730983232972412465021431944501",
"328951535400867065913774686184850193988",
"126559032863743129003261072993622691242",
"241557549824412578063618515488641313393",
"250340381472027402662160077531391171362",
"217400169656094382785522165787099484402",
"53908311946710347262584001449116392477",
"55174064218858269321208328675538819893",
"102790490907243791716660274027801065528",
"262091781080118727956853281854742579003",
"118165333558327811010028685776441142009",
"228384146663231868468583167631228730420",
"240268149512884861902243252638530719117",
"18126386611783713293665314318094276480",
"139892415694333627752823595484362029167",
"105929589962549284948085513984761794260",
"64877573969902052388175817050459431626",
"114544227862381726918919177144944576509",
"109131340524304756553939183452485194688",
"153898311115041534957901358188027620978",
"312401314714696528866273739460888677260",
"339533589847874142352750961655988652426",
"90285232948954770400698699014266647740",
"3030289456088048565526953264547981443",
"92400580694264953240434992306690313231"
],
"threshold": 0.9
},
"id": "CVE-2026-71979-43d7839e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/indilib/indi/commit/96bbd7f564bbb128a129019e44eadd40dd49cff9",
"target": {
"file": "libs/indicore/lilxml.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "254289813107733569275965612496923329836",
"length": 790
},
"id": "CVE-2026-71979-5a78dc07",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/indilib/indi/commit/96bbd7f564bbb128a129019e44eadd40dd49cff9",
"target": {
"file": "libs/indicore/lilxml.cpp",
"function": "main"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"223860768836896871443603228784939868166",
"12436402580434428664111955825238944484",
"9003040263603598542726566505986718453",
"160724329408356063976958328856372801108",
"223860768836896871443603228784939868166",
"12436402580434428664111955825238944484",
"64281968021355562393813713924941059521",
"93567482804472692046733016845271928040"
],
"threshold": 0.9
},
"id": "CVE-2026-71979-73ae770a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/indilib/indi/commit/96bbd7f564bbb128a129019e44eadd40dd49cff9",
"target": {
"file": "libs/indibase/defaultdevice.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "148432995025755641895890494263485123229",
"length": 1676
},
"id": "CVE-2026-71979-7ad982b2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/indilib/indi/commit/96bbd7f564bbb128a129019e44eadd40dd49cff9",
"target": {
"file": "libs/indibase/indidome.cpp",
"function": "Dome::LoadParkXML"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "92543496771662118745587580172774933918",
"length": 2714
},
"id": "CVE-2026-71979-7fdede3f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/indilib/indi/commit/3371faeb07f8fa24bae3edfb44a181853a8e9ce7",
"target": {
"file": "drivers/telescope/ieqpro.cpp",
"function": "IEQPro::getStartupData"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "274716511082343039036647093320248459935",
"length": 1438
},
"id": "CVE-2026-71979-81b8ac70",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/indilib/indi/commit/96bbd7f564bbb128a129019e44eadd40dd49cff9",
"target": {
"file": "libs/indibase/defaultdevice.cpp",
"function": "DefaultDevicePrivate::loadINDINicknamesXML"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "63865800749090615097694669017853408564",
"length": 981
},
"id": "CVE-2026-71979-8d8f0e51",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/indilib/indi/commit/96bbd7f564bbb128a129019e44eadd40dd49cff9",
"target": {
"file": "libs/indicore/lilxml.cpp",
"function": "readXMLEle"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"56976321958002745033979107895047193188",
"209164995482500519420199896396724350382",
"53546008235066901119385681958321526659",
"159789871022030110402459080204641540851"
],
"threshold": 0.9
},
"id": "CVE-2026-71979-adf03e2f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/indilib/indi/commit/96bbd7f564bbb128a129019e44eadd40dd49cff9",
"target": {
"file": "indiserver/MsgQueue.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "330712366454344209704450157849875864320",
"length": 3201
},
"id": "CVE-2026-71979-b0fb4ce5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/indilib/indi/commit/3371faeb07f8fa24bae3edfb44a181853a8e9ce7",
"target": {
"file": "drivers/telescope/ieqpro.cpp",
"function": "IEQPro::initProperties"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "196154034749858848343729048339866903162",
"length": 712
},
"id": "CVE-2026-71979-c92a3a1e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/indilib/indi/commit/3371faeb07f8fa24bae3edfb44a181853a8e9ce7",
"target": {
"file": "drivers/telescope/ieqpro.cpp",
"function": "IEQPro::IEQPro"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "273614598099358668128131024603034987347",
"length": 1473
},
"id": "CVE-2026-71979-cfb995d5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/indilib/indi/commit/96bbd7f564bbb128a129019e44eadd40dd49cff9",
"target": {
"file": "libs/indibase/defaultdevice.cpp",
"function": "DefaultDevicePrivate::saveINDINicknamesXML"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "163755547866755806453506308028770467225",
"length": 3244
},
"id": "CVE-2026-71979-d19a2024",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/indilib/indi/commit/96bbd7f564bbb128a129019e44eadd40dd49cff9",
"target": {
"file": "libs/indicore/lilxml.cpp",
"function": "parseXMLChunk"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"165303788897240068697348475142730777409",
"206538775650921767047640899579943066608",
"327007042111100444129002593109116647570",
"66778076285337211403892773378108776926",
"165303788897240068697348475142730777409",
"206538775650921767047640899579943066608",
"327007042111100444129002593109116647570",
"66778076285337211403892773378108776926"
],
"threshold": 0.9
},
"id": "CVE-2026-71979-d562b117",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/indilib/indi/commit/96bbd7f564bbb128a129019e44eadd40dd49cff9",
"target": {
"file": "libs/indibase/inditelescope.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "111319633444543681601797153649301989065",
"length": 2022
},
"id": "CVE-2026-71979-d888b2fe",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/indilib/indi/commit/96bbd7f564bbb128a129019e44eadd40dd49cff9",
"target": {
"file": "drivers/auxiliary/joystick.cpp",
"function": "JoyStick::loadCalibrationData"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"282073449362442711868934890392855632221",
"4213625013433800710294569792737917920",
"252858200745520417560144258049897906920",
"45854818152363009976724203227412066796",
"241156480456234877753778529250560120173",
"318350410878914671868385201152456481284",
"117320007346471564125619517538497241205",
"130661512790519351899976357315468938581"
],
"threshold": 0.9
},
"id": "CVE-2026-71979-e0061c1b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/indilib/indi/commit/96bbd7f564bbb128a129019e44eadd40dd49cff9",
"target": {
"file": "drivers/auxiliary/joystick.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "164503887531401681292410354185575255860",
"length": 2425
},
"id": "CVE-2026-71979-e5045718",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/indilib/indi/commit/96bbd7f564bbb128a129019e44eadd40dd49cff9",
"target": {
"file": "obsolete/skywatcherAltAzSimple.cpp",
"function": "SkywatcherAltAzSimple::UpdateScopeConfigSwitch"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "52772876719542205115717121984771648872",
"length": 2340
},
"id": "CVE-2026-71979-e6498f0c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/indilib/indi/commit/96bbd7f564bbb128a129019e44eadd40dd49cff9",
"target": {
"file": "drivers/auxiliary/joystick.cpp",
"function": "JoyStick::saveCalibrationData"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"204483425848292873037335528256647875968",
"13775968348006121169543362888567992101",
"322213897892461492861467339105269848258",
"253262063641474011717868527598661085853"
],
"threshold": 0.9
},
"id": "CVE-2026-71979-edf1a277",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/indilib/indi/commit/96bbd7f564bbb128a129019e44eadd40dd49cff9",
"target": {
"file": "obsolete/skywatcherAltAzSimple.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "285600556567049420952702842414963252995",
"length": 1148
},
"id": "CVE-2026-71979-f14c1d96",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/indilib/indi/commit/96bbd7f564bbb128a129019e44eadd40dd49cff9",
"target": {
"file": "indiserver/MsgQueue.cpp",
"function": "MsgQueue::readFromFd"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"298717578725305010675445284501144271695",
"337587826949008615911593267045095165695",
"183937789708203415998664980026461859305",
"134899078005695636385183178598420106192",
"270787531796176215793638053590980311",
"218180982253284012070266454959751328562",
"198268864650498244644511888181315776186",
"134326604785019319831001439497060498997",
"302361938831673512686390188237439032411",
"238857678984961247154910489387814537470",
"113912100031653792885150972403258399563",
"235125986970480074021993097943566099703",
"30636877507219446891121687528043511400",
"234903271078530167265292992670459036061",
"288222387999664259151569256018438640065",
"118334998550116132149666710978998987076"
],
"threshold": 0.9
},
"id": "CVE-2026-71979-f7803855",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/indilib/indi/commit/3371faeb07f8fa24bae3edfb44a181853a8e9ce7",
"target": {
"file": "drivers/telescope/ieqpro.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "122278120421291329434285736225680990677",
"length": 1799
},
"id": "CVE-2026-71979-fe30fa47",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/indilib/indi/commit/96bbd7f564bbb128a129019e44eadd40dd49cff9",
"target": {
"file": "libs/indibase/inditelescope.cpp",
"function": "Telescope::PurgeParkData"
}
}
]
vanir_signatures_modified
"2026-08-19T12:09:58Z"