CVE-2026-26399

MEDIUM

Arduino_Core_STM32 pwm_start() Stack-use-after-return

Generated titleSource: EIP title enrichment
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-26399 has a selected CVSS score of 5.3 (medium); EIP currently links 1 repository PoC.

Description

A stack-use-after-return issue exists in the Arduino_Core_STM32 library prior to version 1.7.0. The pwm_start() function allocates a TIM_HandleTypeDef structure on the stack and passes its address to HAL initialization routines, where it is stored in a global timer handle registry. After the function returns, interrupt service routines may dereference this dangling pointer, resulting in memory corruption.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 21, 2026 · Source: CVE List

Proofs of concept

1

Repository PoCs

GitHubAcen28/CVE-2026-26399-DisclosureRepository PoCby Acen281Writeup1 file

2.9 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a technical disclosure document (README.md) for CVE-2026-26399. It describes a stack-based use-after-return vulnerability in the Arduino_Core_STM32 library, including the affected function, root cause, and potential impact. It contains no exploit or scanner code, only a brief code snippet illustrating the vulnerable pattern.

Backdoor review

No backdoor observed in reviewed code

The artifact consists solely of a README.md file that documents CVE-2026-26399, a stack-based use-after-return vulnerability in Arduino_Core_STM32. The file contains no executable code, no instructions for the reader to perform any action, and no concealed or deceptive payloads. It is a plain-text vulnerability disclosure document.

ClassificationWriteup
Model confidence100%
AuthenticationUnknown
Languagesmarkdownc
Target softwareArduino_Core_STM32
Attack typesuse-after-return
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a single README.md file containing a vulnerability disclosure with technical analysis, affected versions, and impact description. It includes a short code snippet for illustration but no functional exploit or scanner code. This matches the definition of a writeup.

README.md:1-74

Requirements

  • The vulnerable library must be integrated into firmware and the pwm_start() function called.README.md:46

Observed behavior

  • The document describes a vulnerability where a stack-allocated TIM_HandleTypeDef is passed to HAL routines, stored globally, and later dereferenced after the function returns.README.md:7README.md:35-37
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Disclosure
CVE-2026-26399The entire artifact is a documentation file describing a known vulnerability, its technical details, affected versions, and fix information.README.md:1-74
Review boundaries

What the analysis did not establish

  • Only one file (README.md) was provided; no other source code or binaries were included.
  • The analysis is based solely on the text content; no execution or dynamic analysis was performed.
  • Only the README.md file was reviewed; no other files exist in the artifact. The analysis scope confirms complete coverage for readable selected text.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

3