Bug 2511559 (CVE-2026-71265)

Summary: CVE-2026-71265 Domoticz: Domoticz: Stack Buffer Overflow via MochadTCP MOCHAD_RFSEC message processing
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Domoticz. The MochadTCP component in Domoticz contains a stack buffer overflow vulnerability. This flaw occurs when the `MatchLine()` handler processes MOCHAD_RFSEC messages, copying network-received data into a fixed-size buffer without proper length checks. A remote attacker on the local network, able to reach the Mochad TCP bridge, could send a crafted packet to overflow this buffer, potentially leading to arbitrary code execution or denial of service (DoS).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2521846    
Bug Blocks:    

Description OSIDB Bzimport 2026-08-05 14:03:16 UTC 
Domoticz's MochadTCP::MatchLine() handler for MOCHAD_RFSEC messages (hardware/MochadTCP.cpp) copies network-received data from the up-to-1028-byte m_mochadbuffer into a fixed 50-byte stack buffer tempRFSECbuf using strcpy() with no length check, across three separate code branches (DS10A/KR10A/MS10A device types). An attacker on the local network segment able to reach the Mochad TCP bridge (default port 1099, no authentication) can send a crafted packet that overflows tempRFSECbuf by up to several hundred bytes, corrupting the Domoticz worker thread's stack.