{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "WireGuard-Linux Stack-Based Buffer",
          "vendor": "Wireguard",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "*Description:*\nA stack-based buffer overflow exists in the Linux Industrial I/O (IIO)\nuserspace utility lsiio. The vulnerability occurs in the\nfind_type_by_name() function, where the program reads an unbounded string\nfrom a filesystem-backed attribute into a fixed-size stack buffer using\nfscanf(\"%s\", ...).\nIf a crafted or oversized attribute value is present, the unbounded read\ncauses a write beyond the bounds of the destination stack buffer, resulting\nin stack memory corruption.\n\n*Affected Component:*\n\n   - Project: Linux kernel userspace tools\n   - Component: tools/iio/lsiio\n   - Source file: tools/iio/iio_utils.c (compiled via iio_utils-in.c)\n   - Function: find_type_by_name()\n\n\n*Attack Vector:*\n\n   - Local\n   - An attacker who can influence the contents of the filesystem\n   attributes read by lsiio (e.g., via a crafted sysfs-like directory or\n   malicious environment) can trigger the overflow.\n\n\n*Vulnerable Code:*\nThe vulnerable code performs an unbounded string read:\nchar name[IIO_MAX_NAME_LENGTH];\n...\nfscanf(namefp, \"%s\", name);\n\n*Impact:*\nDenial of Service: The application crashes reliably due to stack corruption.\nMemory Corruption: Stack memory is overwritten, which may be exploitable\ndepending on build configuration, compiler protections, and runtime\nenvironment. Although the issue is triggered locally, lsiio is shipped with\nmultiple Linux distributions as part of kernel userspace tooling, and the\nvulnerable code executes prior to any bounds validation.\n\n*Proof of Concept:*\n# python3 -c \u0027print(\"A\" * 4096)\u0027 \u003e /tmp/iio/devices/iio:device0/name\n# wc -c /tmp/iio/devices/iio:device0/name\n4097 /tmp/iio/devices/iio:device0/name\n\n*Output:*\n\n# ./lsiio\n=================================================================\n==169698==ERROR: AddressSanitizer: stack-buffer-overflow on address\n0xfbff91900060 at pc 0xaaaabaf3fb10 bp 0xfffff130c8d0 sp 0xfffff130c0a8\nWRITE of size 4097 at 0xfbff91900060 thread T0\n    #0 0xaaaabaf3fb0c  (/root/wireguard-linux/tools/iio/lsiio+0x5fb0c)\n(BuildId: 6e2b994e1a38e5b227745ec0d1360f58d96f0846)\n    #1 0xaaaabaf40a04  (/root/wireguard-linux/tools/iio/lsiio+0x60a04)\n(BuildId: 6e2b994e1a38e5b227745ec0d1360f58d96f0846)\n    #2 0xaaaabb00d3d4  (/root/wireguard-linux/tools/iio/lsiio+0x12d3d4)\n(BuildId: 6e2b994e1a38e5b227745ec0d1360f58d96f0846)\n    #3 0xaaaabb002b04  (/root/wireguard-linux/tools/iio/lsiio+0x122b04)\n(BuildId: 6e2b994e1a38e5b227745ec0d1360f58d96f0846)\n    #4 0xaaaabb0021fc  (/root/wireguard-linux/tools/iio/lsiio+0x1221fc)\n(BuildId: 6e2b994e1a38e5b227745ec0d1360f58d96f0846)\n    #5 0xaaaabb001ec0  (/root/wireguard-linux/tools/iio/lsiio+0x121ec0)\n(BuildId: 6e2b994e1a38e5b227745ec0d1360f58d96f0846)\n    #6 0xffff93982598  (/lib/aarch64-linux-gnu/libc.so.6+0x22598) (BuildId:\n7544444e7eeafbb5a7ecaf94fc3ebebd2b986846)\n    #7 0xffff93982678  (/lib/aarch64-linux-gnu/libc.so.6+0x22678) (BuildId:\n7544444e7eeafbb5a7ecaf94fc3ebebd2b986846)\n    #8 0xaaaabaf1b26c  (/root/wireguard-linux/tools/iio/lsiio+0x3b26c)\n(BuildId: 6e2b994e1a38e5b227745ec0d1360f58d96f0846)\n\nAddress 0xfbff91900060 is located in stack of thread T0 at offset 96 in\nframe\n    #0 0xaaaabb0027b0  (/root/wireguard-linux/tools/iio/lsiio+0x1227b0)\n(BuildId: 6e2b994e1a38e5b227745ec0d1360f58d96f0846)\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:09:50Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/17"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/17"
        },
        {
          "url": "https://github.com/ob1sec"
        },
        {
          "url": "https://linkedin.com/in/yourhandle"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.linkedin.com/in/ronedgerson1"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/17"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "WireGuard-Linux Stack-Based Buffer Overflow in lsiio (Linux IIO Userspace Tool) Due to Unbounded fscanf",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0005",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/17",
            "automated": true,
            "contentSha256": "e8715268b91f48cad7e419ae73ffd61eafc139f3587a7f13ebbd0c40ca39b999",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/17",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-30T23:49:32Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T06:42:13Z",
    "dateUpdated": "2026-09-09T10:09:50Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0005"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}