Vulnerability-Lookup

CVE-2026-2246 (GCVE-0-2026-2246)

Vulnerability from cvelistv5 – Published: 2026-02-09 19:32 – Updated: 2026-02-23 10:01 X_Open Source

Title

AprilRobotics apriltag apriltag.c apriltag_detector_detect memory corruption

Summary

A security vulnerability has been detected in AprilRobotics apriltag up to 3.4.5. Affected by this vulnerability is the function apriltag_detector_detect of the file apriltag.c. The manipulation leads to memory corruption. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The identifier of the patch is cfac2f5ce1ffe2de25967eb1ab80bc5d99fc1a61. It is suggested to install a patch to address this issue.

Severity ?

4.8 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

3.3 (Low)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

3.3 (Low)


                        
                          CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

CWE

CWE-119 - Memory Corruption

Assigner

VulDB

References

URL

Tags

	https://vuldb.com/?id.344994	vdb-entrytechnical-description
	https://vuldb.com/?ctiid.344994	signaturepermissions-required
	https://vuldb.com/?submit.753162	third-party-advisory
	https://github.com/AprilRobotics/apriltag/issues/422	issue-tracking
	https://github.com/AprilRobotics/apriltag/issues/…	issue-tracking
	https://github.com/oneafter/0120/blob/main/repro	exploit
	https://github.com/AprilRobotics/apriltag/commit/…	patch
	https://github.com/AprilRobotics/apriltag/	product

Impacted products

	Vendor	Product	Version
	AprilRobotics	apriltag	Affected: 3.4.0 Affected: 3.4.1 Affected: 3.4.2 Affected: 3.4.3 Affected: 3.4.4 Affected: 3.4.5

Credits

Oneafter (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-2246",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-10T20:02:16.968974Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-10T20:02:31.339Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "apriltag",
          "vendor": "AprilRobotics",
          "versions": [
            {
              "status": "affected",
              "version": "3.4.0"
            },
            {
              "status": "affected",
              "version": "3.4.1"
            },
            {
              "status": "affected",
              "version": "3.4.2"
            },
            {
              "status": "affected",
              "version": "3.4.3"
            },
            {
              "status": "affected",
              "version": "3.4.4"
            },
            {
              "status": "affected",
              "version": "3.4.5"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Oneafter (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A security vulnerability has been detected in AprilRobotics apriltag up to 3.4.5. Affected by this vulnerability is the function apriltag_detector_detect of the file apriltag.c. The manipulation leads to memory corruption. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The identifier of the patch is cfac2f5ce1ffe2de25967eb1ab80bc5d99fc1a61. It is suggested to install a patch to address this issue."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 1.7,
            "vectorString": "AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-119",
              "description": "Memory Corruption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-23T10:01:08.922Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-344994 | AprilRobotics apriltag apriltag.c apriltag_detector_detect memory corruption",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.344994"
        },
        {
          "name": "VDB-344994 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.344994"
        },
        {
          "name": "Submit #753162 | AprilRobotics apriltag c2172a2 Memory Corruption",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/?submit.753162"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/AprilRobotics/apriltag/issues/422"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/AprilRobotics/apriltag/issues/422#issuecomment-3797661933"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/oneafter/0120/blob/main/repro"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/AprilRobotics/apriltag/commit/cfac2f5ce1ffe2de25967eb1ab80bc5d99fc1a61"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/AprilRobotics/apriltag/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-02-09T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-02-09T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-02-10T04:31:22.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "AprilRobotics apriltag apriltag.c apriltag_detector_detect memory corruption"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-2246",
    "datePublished": "2026-02-09T19:32:07.858Z",
    "dateReserved": "2026-02-09T12:15:21.978Z",
    "dateUpdated": "2026-02-23T10:01:08.922Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-2246\",\"sourceIdentifier\":\"cna@vuldb.com\",\"published\":\"2026-02-09T20:15:59.467\",\"lastModified\":\"2026-02-09T21:55:30.093\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A security vulnerability has been detected in AprilRobotics apriltag up to 3.4.5. Affected by this vulnerability is the function apriltag_detector_detect of the file apriltag.c. The manipulation leads to memory corruption. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The identifier of the patch is cfac2f5ce1ffe2de25967eb1ab80bc5d99fc1a61. It is suggested to install a patch to address this issue.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":4.8,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"LOW\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"PROOF_OF_CONCEPT\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L\",\"baseScore\":3.3,\"baseSeverity\":\"LOW\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":1.8,\"impactScore\":1.4}],\"cvssMetricV2\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:S/C:N/I:N/A:P\",\"baseScore\":1.7,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":3.1,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-119\"}]}],\"references\":[{\"url\":\"https://github.com/AprilRobotics/apriltag/\",\"source\":\"cna@vuldb.com\"},{\"url\":\"https://github.com/AprilRobotics/apriltag/commit/cfac2f5ce1ffe2de25967eb1ab80bc5d99fc1a61\",\"source\":\"cna@vuldb.com\"},{\"url\":\"https://github.com/AprilRobotics/apriltag/issues/422\",\"source\":\"cna@vuldb.com\"},{\"url\":\"https://github.com/AprilRobotics/apriltag/issues/422#issuecomment-3797661933\",\"source\":\"cna@vuldb.com\"},{\"url\":\"https://github.com/oneafter/0120/blob/main/repro\",\"source\":\"cna@vuldb.com\"},{\"url\":\"https://vuldb.com/?ctiid.344994\",\"source\":\"cna@vuldb.com\"},{\"url\":\"https://vuldb.com/?id.344994\",\"source\":\"cna@vuldb.com\"},{\"url\":\"https://vuldb.com/?submit.753162\",\"source\":\"cna@vuldb.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-2246\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-02-10T20:02:16.968974Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-02-10T20:02:23.427Z\"}}], \"cna\": {\"tags\": [\"x_open-source\"], \"title\": \"AprilRobotics apriltag apriltag.c apriltag_detector_detect memory corruption\", \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Oneafter (VulDB User)\"}], \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 4.8, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P\"}}, {\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 3.3, \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C\"}}, {\"cvssV3_0\": {\"version\": \"3.0\", \"baseScore\": 3.3, \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C\"}}, {\"cvssV2_0\": {\"version\": \"2.0\", \"baseScore\": 1.7, \"vectorString\": \"AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C\"}}], \"affected\": [{\"vendor\": \"AprilRobotics\", \"product\": \"apriltag\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.4.0\"}, {\"status\": \"affected\", \"version\": \"3.4.1\"}, {\"status\": \"affected\", \"version\": \"3.4.2\"}, {\"status\": \"affected\", \"version\": \"3.4.3\"}, {\"status\": \"affected\", \"version\": \"3.4.4\"}, {\"status\": \"affected\", \"version\": \"3.4.5\"}]}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-02-09T00:00:00.000Z\", \"value\": \"Advisory disclosed\"}, {\"lang\": \"en\", \"time\": \"2026-02-09T01:00:00.000Z\", \"value\": \"VulDB entry created\"}, {\"lang\": \"en\", \"time\": \"2026-02-10T04:31:22.000Z\", \"value\": \"VulDB entry last update\"}], \"references\": [{\"url\": \"https://vuldb.com/?id.344994\", \"name\": \"VDB-344994 | AprilRobotics apriltag apriltag.c apriltag_detector_detect memory corruption\", \"tags\": [\"vdb-entry\", \"technical-description\"]}, {\"url\": \"https://vuldb.com/?ctiid.344994\", \"name\": \"VDB-344994 | CTI Indicators (IOB, IOC, IOA)\", \"tags\": [\"signature\", \"permissions-required\"]}, {\"url\": \"https://vuldb.com/?submit.753162\", \"name\": \"Submit #753162 | AprilRobotics apriltag c2172a2 Memory Corruption\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://github.com/AprilRobotics/apriltag/issues/422\", \"tags\": [\"issue-tracking\"]}, {\"url\": \"https://github.com/AprilRobotics/apriltag/issues/422#issuecomment-3797661933\", \"tags\": [\"issue-tracking\"]}, {\"url\": \"https://github.com/oneafter/0120/blob/main/repro\", \"tags\": [\"exploit\"]}, {\"url\": \"https://github.com/AprilRobotics/apriltag/commit/cfac2f5ce1ffe2de25967eb1ab80bc5d99fc1a61\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/AprilRobotics/apriltag/\", \"tags\": [\"product\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A security vulnerability has been detected in AprilRobotics apriltag up to 3.4.5. Affected by this vulnerability is the function apriltag_detector_detect of the file apriltag.c. The manipulation leads to memory corruption. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The identifier of the patch is cfac2f5ce1ffe2de25967eb1ab80bc5d99fc1a61. It is suggested to install a patch to address this issue.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-119\", \"description\": \"Memory Corruption\"}]}], \"providerMetadata\": {\"orgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"shortName\": \"VulDB\", \"dateUpdated\": \"2026-02-23T10:01:08.922Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-2246\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-02-23T10:01:08.922Z\", \"dateReserved\": \"2026-02-09T12:15:21.978Z\", \"assignerOrgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"datePublished\": \"2026-02-09T19:32:07.858Z\", \"assignerShortName\": \"VulDB\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-574P-352P-PGRC

Vulnerability from github – Published: 2026-02-09 21:31 – Updated: 2026-02-09 21:31

Details

Severity ?

3.3 (Low)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

1.9 (Low)


                  
                    CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-2246"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-119"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-09T20:15:59Z",
    "severity": "MODERATE"
  },
  "details": "A security vulnerability has been detected in AprilRobotics apriltag up to 3.4.5. Affected by this vulnerability is the function apriltag_detector_detect of the file apriltag.c. The manipulation leads to memory corruption. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The identifier of the patch is cfac2f5ce1ffe2de25967eb1ab80bc5d99fc1a61. It is suggested to install a patch to address this issue.",
  "id": "GHSA-574p-352p-pgrc",
  "modified": "2026-02-09T21:31:04Z",
  "published": "2026-02-09T21:31:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2246"
    },
    {
      "type": "WEB",
      "url": "https://github.com/AprilRobotics/apriltag/issues/422"
    },
    {
      "type": "WEB",
      "url": "https://github.com/AprilRobotics/apriltag/issues/422#issuecomment-3797661933"
    },
    {
      "type": "WEB",
      "url": "https://github.com/AprilRobotics/apriltag/commit/cfac2f5ce1ffe2de25967eb1ab80bc5d99fc1a61"
    },
    {
      "type": "WEB",
      "url": "https://github.com/AprilRobotics/apriltag"
    },
    {
      "type": "WEB",
      "url": "https://github.com/oneafter/0120/blob/main/repro"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.344994"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.344994"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.753162"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

FKIE_CVE-2026-2246

Vulnerability from fkie_nvd - Published: 2026-02-09 20:15 - Updated: 2026-02-09 21:55

Severity ?

3.3 (Low) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Summary

References

	URL	Tags
	cna@vuldb.com	https://github.com/AprilRobotics/apriltag/
	cna@vuldb.com	https://github.com/AprilRobotics/apriltag/commit/cfac2f5ce1ffe2de25967eb1ab80bc5d99fc1a61
	cna@vuldb.com	https://github.com/AprilRobotics/apriltag/issues/422
	cna@vuldb.com	https://github.com/AprilRobotics/apriltag/issues/422#issuecomment-3797661933
	cna@vuldb.com	https://github.com/oneafter/0120/blob/main/repro
	cna@vuldb.com	https://vuldb.com/?ctiid.344994
	cna@vuldb.com	https://vuldb.com/?id.344994
	cna@vuldb.com	https://vuldb.com/?submit.753162

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A security vulnerability has been detected in AprilRobotics apriltag up to 3.4.5. Affected by this vulnerability is the function apriltag_detector_detect of the file apriltag.c. The manipulation leads to memory corruption. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The identifier of the patch is cfac2f5ce1ffe2de25967eb1ab80bc5d99fc1a61. It is suggested to install a patch to address this issue."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de seguridad ha sido detectada en AprilRobotics apriltag hasta 3.4.5. Afectada por esta vulnerabilidad es la funci\u00f3n apriltag_detector_detect del archivo apriltag.c. La manipulaci\u00f3n conduce a corrupci\u00f3n de memoria. El ataque debe ser llevado a cabo localmente. El exploit ha sido divulgado p\u00fablicamente y puede ser usado. El identificador del parche es cfac2f5ce1ffe2de25967eb1ab80bc5d99fc1a61. Se sugiere instalar un parche para abordar este problema."
    }
  ],
  "id": "CVE-2026-2246",
  "lastModified": "2026-02-09T21:55:30.093",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 1.7,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:L/AC:L/Au:S/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "cna@vuldb.com",
        "type": "Secondary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "LOW",
          "baseScore": 3.3,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 1.4,
        "source": "cna@vuldb.com",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "LOCAL",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 4.8,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "PROOF_OF_CONCEPT",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "LOW",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "cna@vuldb.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-02-09T20:15:59.467",
  "references": [
    {
      "source": "cna@vuldb.com",
      "url": "https://github.com/AprilRobotics/apriltag/"
    },
    {
      "source": "cna@vuldb.com",
      "url": "https://github.com/AprilRobotics/apriltag/commit/cfac2f5ce1ffe2de25967eb1ab80bc5d99fc1a61"
    },
    {
      "source": "cna@vuldb.com",
      "url": "https://github.com/AprilRobotics/apriltag/issues/422"
    },
    {
      "source": "cna@vuldb.com",
      "url": "https://github.com/AprilRobotics/apriltag/issues/422#issuecomment-3797661933"
    },
    {
      "source": "cna@vuldb.com",
      "url": "https://github.com/oneafter/0120/blob/main/repro"
    },
    {
      "source": "cna@vuldb.com",
      "url": "https://vuldb.com/?ctiid.344994"
    },
    {
      "source": "cna@vuldb.com",
      "url": "https://vuldb.com/?id.344994"
    },
    {
      "source": "cna@vuldb.com",
      "url": "https://vuldb.com/?submit.753162"
    }
  ],
  "sourceIdentifier": "cna@vuldb.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "cna@vuldb.com",
      "type": "Primary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-2246 (GCVE-0-2026-2246)

GHSA-574P-352P-PGRC

FKIE_CVE-2026-2246

Tags

Sightings

Nomenclature