CVE-2026-42799

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Out-of-bounds read vulnerability in ASR Kestrel (nr_fw modules) allows Overflow Buffers.

This vulnerability is associated with program files Code/Nr/nr_fw/RA/src/NrPwrCtrl.C.

This issue affects Kestrel: before 2026/02/10.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published
Apr 30, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-42806.5The Breaking News WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3. This is due to thCVE-2026-428005.3NULL pointer dereference vulnerability in ASR1903 in ASR Lapwing_Linux on Linux (ims_client modules) allows Pointer Manipulation. This vulCVE-2026-428017.4NULL pointer dereference vulnerability in ASR Crane，Falcon on Linux (as_rrc module) allows Pointer Manipulation. This vulnerability is assoCVE-2026-428047.6A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI360 SensorAPI(C-Library) in versions up to and including commitCVE-2026-428058.4A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI385 SensorAPI (C library) within the debug message parser functCVE-2026-428064.3An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI (C-driver) in version v1.0.3 and prior, specifically withinCVE-2026-428078.0A heap-based buffer overflow vulnerability in the PC bridge protocol decoder of BoschSensortec COINES_SDK (versions 2.10 through 2.12.2) allCVE-2026-428086.8An issue was discovered in Bosch Sensortec COINES_SDK versions 2.0 through 2.11.  The host streaming API function {{coines_read_stream_seCVE-2026-428099.9Apache Polaris can issue broad temporary ("vended") storage credentials during staged table creation before the effective table location hasCVE-2026-42815.3The FormLift for Infusionsoft Web Forms plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 7.CVE-2026-428109.9Apache Polaris accepts literal `*` characters in namespace and table names. When it later builds temporary S3 access policies for delegated CVE-2026-428119.9In plain terms, Apache Polaris is supposed to issue short-lived GCS credentials that only work for one table's files, but a crafted namespac
CVE-2026-42799: Critical severity, CVSS 9.8 | Vulnix