Most recent entries from all

fkie_cve-2026-102713

2026-09-30T19:39:21.718833+00:00

The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than

four bytes (nxd_tftp_server.c:1037) and nothing anywhere checks an upper bound, in particular not

against the protocol maximum of 4 + NX_TFTP_FILE_TRANSFER_MAX. Two things follow from that one

missing check, both reachable before any authentication because TFTP has none.

The handler passes `nx_packet_length - 4` straight to FileX:

```c

/* addons/tftp/nxd_tftp_server.c:1863, 1889 */

status = nx_packet_copy(packet_ptr, &temp_ptr,

server_ptr -> nx_tftp_server_packet_pool_ptr, NX_WAIT_FOREVER);

...

fx_file_write(&(client_request_ptr -> nx_tftp_client_request_file),

packet_ptr -> nx_packet_prepend_ptr + 4, packet_ptr -> nx_packet_length - 4);

```

`nx_packet_length` is the length of a chain, not of one contiguous buffer, so FileX copies past the

end of the first packet:

```

ERROR: AddressSanitizer: heap-buffer-overflow

READ of size 1280 at 0x621000001108 thread T5

#0 __interceptor_memcpy #1 _fx_utility_memory_copy filex/common/src/fx_utility_memory_copy.c:78

0x621000001108 is 0 bytes to the right of 4104-byte region

```

Those bytes are written into the file the attacker is uploading, and a TFTP read request hands them

back, so this is a memory disclosure with a convenient retrieval channel.

The same datagram also wedges the server. `nx_packet_copy` at :1863 needs…

GHSA-fhxv-gc8j-2f6h

2026-09-30T19:39:21.719021+00:00