CVE-2026-30363:
A stack-based buffer overflow vulnerability exists in the "Main" function of flipperzero-firmware at commit ad2a80, potentially allowing an attacker to compromise confidentiality, integrity, and availability of the affected system.
Score
A numerical rating that indicates how dangerous this vulnerability is.
8.4High- Published Date:May 1, 2026
- CISA KEV Date:*No Data*
- Industries Affected:20
Threat Predictions
- EPSS Score:0.0
- EPSS Percentile:2%
Exploitability
- Score:2.5
- Attack Vector:LOCAL
- Attack Complexity:LOW
- Privileges Required:NONE
- User Interaction:NONE
- Scope:UNCHANGED
Impact
- Score:5.9
- Confidentiality Impact:HIGH
- Integrity Impact:HIGH
- Availability Impact:HIGH
Description Preview
A stack-based buffer overflow vulnerability exists in the "Main" function of flipperzero-firmware at commit ad2a80, potentially allowing an attacker to compromise confidentiality, integrity, and availability of the affected system.
Overview
CVE-2026-30363 affects the flipperzero-firmware project at commit ad2a80 and involves a stack-based buffer overflow in the "Main" function. This class of vulnerability (CWE-121) occurs when data written to a stack-allocated buffer exceeds its defined boundaries, potentially allowing an attacker to overwrite critical stack memory including return addresses or saved registers. On embedded devices such as the Flipper Zero, this can lead to arbitrary code execution or device crashes. The vulnerability is rated HIGH severity with a CVSS 3.1 score of 8.4, exploitable locally without any privileges or user interaction, making it a significant risk for users running the affected firmware version.
Remediation
- Users and administrators running flipperzero-firmware at commit ad2a80 should update to a patched version of the firmware as soon as one becomes available from the Flipper Devices official repository. Users should monitor the official GitHub repository and associated issue tracker for patches or updated releases addressing this vulnerability. As a general mitigation, avoid loading untrusted applications or firmware modifications on affected devices until a fix is applied. Review the referenced GitHub issue and proof-of-concept for further technical context that may assist in developing interim mitigations.
References
Industries Affected
Below is a list of industries most commonly impacted or potentially at risk based on intelligence.
