CVE-2026-49035
A heap-based buffer overflow exists in an MMS service that can be triggered by a specially crafted Initiate request. The flaw can lead to remote code execution when address space layout randomization (ASLR) is disabled, or to memory corruption and denial of service when ASLR is enabled. The vulnerability is rated critical.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
The specific product affected is not identified in the provided data; the vulnerability is reported for an MMS service that accepts Initiate requests.
Real-world impact
An attacker who can send a crafted MMS Initiate request to the vulnerable service can run arbitrary code on the host, potentially taking full control of the system. If ASLR is enabled, the attacker may still cause memory corruption or a denial‑of‑service condition.
Why this severity
The CVSS score of 9.2 reflects a high exploitation difficulty (high attack complexity) but a very high impact: the vulnerability allows remote code execution with no user interaction, and the potential for denial of service or memory corruption. The lack of required privileges and the ability to exploit over the network contribute to the critical rating.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 23, 2026 · 8d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 30, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.