Low severity · published Oct 6, 2026
CVE-2026-106026
tftp-hpa 5.4 before 6.0 Out-of-Bounds Read via tftpd Remap Jump Rule
3.7
CVSS
0.4%
EPSS
No
On KEV
Description
tftp-hpa 5.4 before 6.0 contains an out-of-bounds read vulnerability in rewrite_string() in tftpd/remap.c that walks heap memory during jump label searches. Unauthenticated remote attackers can send read or write requests whose filename matches a remap jump rule to crash the forked in.tftpd request handler.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TF
tftp-hpa · H. Peter Anvin
5.4 before 6.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-106026
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-106026
patch
https://git.kernel.org/pub/scm/network/tftp/tftp-hpa.git/commit/?id=6735086fb6475c3e1f1daf9829836b3d06f14291
technical-description
https://git.kernel.org/pub/scm/network/tftp/tftp-hpa.git/tree/tftpd/remap.c?h=tftp-hpa-5.4#n762
product
https://git.kernel.org/pub/scm/network/tftp/tftp-hpa.git/
third-party-advisory
https://www.vulncheck.com/advisories/tftp-hpa-5.4-before-6.0-out-of-bounds-read-via-tftpd-remap-jump-rule
More from tftp-hpa
–
CVE-2011-2199
Buffer overflow in tftp-hpa before 5.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via the utimeout option