CVE-2026-94582 Memory corruption in Fabric OS
An attacker chaining vulnerabilities can exploit a buffer overflow in FSPF diagnostics to crash the routing daemon or execute arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-94582?
CVE-2026-94582 is a medium-severity memory corruption vulnerability in Broadcom Fabric Operating System, published on 8 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A memory buffer overflow vulnerability exists in the internal diagnostic and route validation routines used by the Fabric Shortest Path First (FSPF) protocol component of Brocade Fabric OS versions before 10.0.1. While this code path is part of internal diagnostic functionality and is not directly accessible via standard user interfaces or CLI management commands, an input processing flaw allows incoming or internally routed diagnostic state payloads to exceed allocated memory boundaries. An attacker that is able to chain or link other vulnerabilities to exploit this internal diagnostic could cause a heap- or stack-based memory overrun, resulting in a daemon crash (Denial of Service) or potential arbitrary code execution within the context of the routing daemon.
Weakness: CWE-120
Which versions are affected by CVE-2026-94582?
It affects 1 product.
Products include Broadcom Fabric Operating System.
How do I fix CVE-2026-94582?
No fix has been published for CVE-2026-94582 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-94582 being exploited?
There is no known exploitation of CVE-2026-94582 in the wild and no public exploit code.
Other vulnerabilities in Broadcom Fabric Operating System
Sources
Also known as GHSA-7gvw-9x94-58g3.