PT-2026-7491 · Canonical · Arduino

Published 2026-02-11 · Updated 2026-04-21 · CVE-2026-26399

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Arduino Core STM32 versions prior to 1.7.0

Description A stack-use-after-return issue occurs when the pwm start() function allocates a TIM HandleTypeDef structure on the stack and passes its address to HAL initialization routines, which then store it in a global timer handle registry. Once the function returns, interrupt service routines may dereference this dangling pointer, leading to memory corruption.

Recommendations Update to version 1.7.0 or later.

Exploit

Fix

Weakness Enumeration

CWE-825

CWE-562

Related Identifiers

CVE-2026-26399

Affected Products

Arduino

References · 10

• 🔥 https://github.com/Acen28/CVE-2026-26399-Disclosure · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-26399 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-26399 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-26399 · Security Note
• https://ubuntu.com/security/CVE-2026-26399 · Vendor Advisory
• https://github.com/stm32duino/Arduino_Core_STM32/releases/tag/1.6.1 · Note
• https://twitter.com/CVEnew/status/2046601514572022014 · Twitter Post
• https://twitter.com/infoflowcloud/status/2046603259339571234 · Twitter Post
• https://twitter.com/ThreatSynop/status/2021384368921440720 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2045898418556379422 · Twitter Post