CVE-2026-63033

MediumCVSS 6.5/10Last modified Oct 23, 2026

Description

A crafted IEC 60870-5-104 I-frame with a declared object count exceeding what fits in the ASDU body causes InformationObject_ParseObjectAddress to read one byte past the end of the heap-allocated message buffer.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published
Jul 30, 2026
Last modified
Oct 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-630358.1A heap use-after-free vulnerability in the TransferSubscriptions service in open62541 may allow an authenticated attacker to cause a denialCVE-2026-630379.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This appears to allow SCVE-2026-630389.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This allows an attackerCVE-2026-630399.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This allows an attackerCVE-2026-63048.3Use after free in Graphite in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to poCVE-2026-630408.1Files or Directories Accessible to External Parties vulnerability in Apache InLong. StreamSource performs no authorization check, any authenCVE-2026-630418.8Reliance on Untrusted Inputs in a Security Decision vulnerability in Apache APISIX. This vulnerability allows an attacker to escalate priviCVE-2026-630428.1Files or Directories Accessible to External Parties vulnerability in Apache InLong. Any user who can authenticate to the manager can create,CVE-2026-630437.5Relative Path Traversal vulnerability in Apache InLong. Arbitrary file read from the Agent host filesystem. This issue affects Apache InLonCVE-2026-630445.4Server-Side Request Forgery (SSRF) vulnerability in Apache InLong.  Any authenticated user (no admin role required) can cause the InLong ManCVE-2026-630457.5Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platfoCVE-2026-630468.8Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache InLong. Agent Installer's ModuleM
CVE-2026-63033: Medium severity, CVSS 6.5 | Vulnix