CVE-2026-26399 - Vulnerability Analysis

Overview

Arduino_Core_STM32 < 1.7.0 contains a use-after-return vulnerability caused by storing a stack-allocated TIM_HandleTypeDef pointer in a global timer handle registry, letting interrupt routines cause memory corruption, exploit requires interrupt triggering after function return.

Severity & Score

Impact

Interrupt routines can dereference dangling pointers causing memory corruption, potentially leading to system instability or code execution.

Mitigation

Update to version 1.7.0 or later.

References

• https://github.com/Acen28/CVE-2026-26399-Disclosure
• https://github.com/stm32duino/Arduino_Core_STM32/releases/tag/1.6.1

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner