PT-2026-24933 · Thakeenathees · Pocketlang

Oneafter · Published 2026-03-12 · Updated 2026-03-13 · CVE-2026-4010

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions pocketlang versions prior to cc73ca61b113d48ee130d837a7a8b145e41de5ce

Description A flaw exists in the pkByteBufferAddString function. Manipulating the length argument with the input 4294967290 leads to memory corruption. The issue requires local access to exploit. The exploit is publicly available. The software does not utilize versioning, making specific affected and unaffected release information unavailable. The project was notified of the issue but has not yet responded.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2026-4010

Affected Products

Pocketlang

References · 11

• 🔥 https://github.com/ThakeeNathees/pocketlang/issues/302 · Exploit
• 🔥 https://github.com/oneafter/0211/blob/main/po/repro · Exploit
• 🔥 https://github.com/ThakeeNathees/pocketlang · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4010 · Security Note
• https://twitter.com/CVEnew/status/2032410977770361011 · Twitter Post
• https://twitter.com/CVEarity/status/2032099870627283359 · Twitter Post
• https://t.me/CVEtracker/47240 · Telegram Post
• https://t.me/cveNotify/155241 · Telegram Post
• https://vuldb.com/?submit.769773 · Note
• https://vuldb.com/?ctiid.350533 · Note
• https://vuldb.com/?id.350533 · Note