Read the docs
TI-2026-35852 Aliases CVE-2026-48490

ArduinoCore-AVR: Stack-Based Buffer Overflow in String float/double concatenation handler

Priority LOW 38CWE-120Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

ArduinoCore-avr contains the source code and configuration files of the Arduino AVR Boards platform. A vulnerability in versions prior to 1.8.8 allows an attacker to trigger a stack-based buffer overflow when concatenating floating-point values of sufficiently large magnitude onto an Arduino String object. By passing values near the extremes of the float or double range to `String::concat(float)`, `String::concat(double)`, `String::operator+=()`, or the `+` operator with a float/double operand, `dtostrf()` writes beyond the fixed-size stack buffer, causing memory corruption and denial of service. Under specific conditions, this could enable arbitrary code execution on AVR-based Arduino boards. The fix is included starting from the `1.8.8 `release.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00668 52nd percentileScored 2026-11-07
Fix Fixed ArduinoCore-avr (arduino): 1.8.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
arduinoArduinoCore-avrbefore 1.8.81.8.8Patch availableCNA
  • ArduinoCore-avr Vendorarduino Affected before 1.8.8 Fixed in 1.8.8 Patch available CNA

Remediation

  • Fix · CNA ArduinoCore-avr (arduino) Fixed in 1.8.8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-48490

References

Other 3

  • TI-2023-23493 Path traversal in Arduino Create Agent CVSS 3.1HIGH 7.8
  • TI-2023-23491 Insufficient Verification of Data Authenticity in Arduino Create Agent CVSS 3.1HIGH 7.8
  • TI-2026-20963 Arduino App Lab has Improper Data Validation in Internal Terminal Interface CVSS 3.1MEDIUM 6.9
  • TI-2023-23494 Path traversal in Arduino Create Agent CVSS 3.1HIGH 7.1
  • TI-2023-23492 Path traversal in Arduino Create Agent CVSS 3.1HIGH 7.1
  • TI-2025-42663 ArduinoCore-avr has Stack-Based Buffer Overflow in WString Float/Double Constructors CVSS 4.0MEDIUM 6.9
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences