CVE-2022-26419

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Omron CX-Position (versions 2.5.3 and prior) is vulnerable to multiple stack-based buffer overflow conditions while parsing a specific project file, which may allow an attacker to locally execute arbitrary code.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121 CWE-787

Affected software

Vendor	Product	Versions
Omron	CX-Position	>= unspecified, <= 2.5.3

References

https://www.cisa.gov/uscert/ics/advisories/icsa-22-088-02Third Party Advisory, US Government Resource
https://www.zerodayinitiative.com/advisories/ZDI-22-575/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-576/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-579/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-580/Third Party Advisory, VDB Entry
https://www.cisa.gov/uscert/ics/advisories/icsa-22-088-02Third Party Advisory, US Government Resource
https://www.zerodayinitiative.com/advisories/ZDI-22-575/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-576/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-579/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-580/Third Party Advisory, VDB Entry

Timeline

Published: Apr 1, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-26427.5Horner Automation’s RCC 972 firmware version 15.40 contains global variables. This could allow an attacker to read out sensitive values and CVE-2022-264208.8An OS command injection vulnerability exists in the console infactory_port functionality of InHand Networks InRouter302 V3.5.37. A specially CVE-2022-264217.3Uncontrolled search path element in the Intel(R) oneAPI DPC++/C++ Compiler Runtime before version 2022.0 may allow an authenticated user to CVE-2022-264237.5Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user crede CVE-2022-264257.3Uncontrolled search path element in the Intel(R) oneAPI Collective Communications Library (oneCCL) before version 2021.6 for Intel(R) oneAPI CVE-2022-264266.7In camera isp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with CVE-2022-264276.7In camera isp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with CVE-2022-264286.4In video codec, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System CVE-2022-264297.8In cta, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local esca CVE-2022-26439.8A vulnerability has been found in SourceCodester Online Admission System and classified as critical. This vulnerability affects unknown code CVE-2022-264306.7In mailbox, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege with System exec CVE-2022-264316.7In mailbox, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with Sys