PT-2026-7491 · Canonical+1 · Arduino+1

CVE-2026-26399 · Published 2026-02-11 · Updated 2026-04-21

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Arduino Core STM32 versions prior to 1.7.0

Description A stack-use-after-return issue occurs when the pwm start() function allocates a TIM HandleTypeDef structure on the stack and passes its address to HAL initialization routines, which then store it in a global timer handle registry. Once the function returns, interrupt service routines may dereference this dangling pointer, leading to memory corruption.

Recommendations Update to version 1.7.0 or later.

Exploit

Fix

Weakness Enumeration

CWE-562

CWE-825

Related Identifiers

CVE-2026-26399

Affected Products

Arduino

Arduino Core Stm32

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26399.json · Exploit
• 🔥 https://github.com/Acen28/CVE-2026-26399-Disclosure · Exploit
• https://osv.dev/vulnerability/CVE-2026-26399 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-26399 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-26399 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-26399 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-26399 · Security Note
• https://github.com/stm32duino/Arduino_Core_STM32/releases/tag/1.6.1 · Note
• https://twitter.com/VulmonFeeds/status/2045898418556379422 · Twitter Post
• https://twitter.com/infoflowcloud/status/2046603259339571234 · Twitter Post
• https://twitter.com/CVEnew/status/2046601514572022014 · Twitter Post
• https://twitter.com/ThreatSynop/status/2021384368921440720 · Twitter Post