PT-2026-4898 · Unknown · Fastshift X-Track

Titan Team · Published 2026-01-27 · Updated 2026-01-27 · CVE-2026-24823

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:Y/R:U/V:C/RE:L/U:Red

Name of the Vulnerable Software and Affected Versions FASTSHIFT X-TRACK versions through 2.7

Description An out-of-bounds write issue, specifically a buffer copy without checking the size of the input ('Classic Buffer Overflow'), exists in FASTSHIFT X-TRACK within the inflate.C file located in the Software/X-Track/USER/App/Utils/lv img png/PNGdec/src modules. This impacts the PNG decoder. The issue is a heap-based buffer over-read.

Recommendations Versions prior to 2.7 should be updated.

Fix

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-120

Related Identifiers

CVE-2026-24823

Affected Products

Fastshift X-Track

References · 6

• https://github.com/FASTSHIFT/X-TRACK/pull/120 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-24823 · Security Note
• https://osv.dev/vulnerability/CVE-2026-24823 · Vendor Advisory
• https://twitter.com/0dayPublishing/status/2016076594318651628 · Twitter Post
• https://t.me/CVEtracker/43049 · Telegram Post
• https://twitter.com/CVEnew/status/2016081231356555309 · Twitter Post