CVE-2026-71979
Description
A flaw was found in INDI indiserver. An unauthenticated remote attacker can exploit a stack buffer overflow vulnerability by sending specially crafted XML with oversized, mismatched tags. This can lead to an unbounded write operation, causing the daemon to crash and disrupting all active client and driver sessions, resulting in a denial of service.
Statement
indiserver's INDI protocol listener (TCP/7624 by default) provides no authentication or transport encryption, so any client that can reach the port is treated as trusted. Its XML chunk parser (lilxml.cpp) formats parser-diagnostic messages -- including the attacker-controlled tag/attribute names that triggered them -- with sprintf() into a fixed 1024-byte stack buffer in indiserver/MsgQueue.cpp, with no bound on the size of those names. A single specially crafted packet containing a mismatched, oversized closing XML tag overflows this buffer and crashes the indiserver process, terminating every connected client and driver session. This is an unauthenticated, single-packet, remotely triggerable denial of service; no confidentiality or integrity impact, and no control-flow hijack, has been demonstrated. The issue affects indiserver through version 2.2.4.2 and is fixed upstream in commit 96bbd7f.
Mitigation
To mitigate this issue, restrict network access to the indiserver daemon's default port (TCP/7624) using firewall rules. If the indiserver is not required, disable the service.
Note that disabling the service will prevent all INDI client and driver sessions from functioning.
Understanding the Weakness (CWE)
Availability
Technical Impact: Modify Memory; DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory)
Buffer overflows generally lead to crashes. Other attacks leading to lack of availability are possible, including putting the program into an infinite loop.
Integrity,Confidentiality,Availability,Access Control
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands; Bypass Protection Mechanism
Buffer overflows often can be used to execute arbitrary code, which is usually outside the scope of a program's implicit security policy.
Integrity,Confidentiality,Availability,Access Control,Other
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands; Bypass Protection Mechanism; Other
When the consequence is arbitrary code execution, this can often be used to subvert any other security service.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
