CVE-2026-103436 Information disclosure in apcupsd
Attackers can read uninitialized stack memory via HTTP responses from apcupsd CGI scripts when processing malformed STATUS lines.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-103436?
CVE-2026-103436 is a low-severity vulnerability in apcupsd, published on 30 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
apcupsd through 3.14.14 discloses uninitialized stack memory in getupsvar() in src/cgi/upsfetch.c (used by upsstats.cgi, multimon.cgi, and upsfstats.cgi. On the single-field path, when the matched STATUS line has fewer than three whitespace-separated tokens, sscanf("%*s %*s %s", answer) performs no assignment but the function returns success, and thus the caller prints the uninitialized destination buffer into the HTTP response.
Weakness: CWE-457
Which versions are affected by CVE-2026-103436?
How do I fix CVE-2026-103436?
No fix has been published for CVE-2026-103436 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-103436 being exploited?
There is no known exploitation of CVE-2026-103436 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-103436, GHSA-8jv2-xm7v-55rg, UBUNTU-CVE-2026-103436.