← Back to the live CVE advisory feed

CVE-2026-48490: Product identification pending

Severity

6.9 (MEDIUM)

Affected versions

Before 1.8.8

Fixed version

1.8.8

Patch status

Patched

Published

2026-09-11T21:17:10.100

Modified

2026-09-11T21:17:10.100

Why it matters

This matters because the affected product may allow code execution. Prioritize systems that are internet-facing or have privileged access to other infrastructure.

Recommended admin actions

• Review during normal vulnerability triage unless the affected system is internet-facing or business-critical.
• Compare installed versions against the affected version range in the advisory.
• Review logs for suspicious activity related to the affected application or component.

Technical summary

ArduinoCore-avr contains the source code and configuration files of the Arduino AVR Boards platform. A vulnerability in versions prior to 1.8.8 allows an attacker to trigger a stack-based buffer overflow when concatenating floating-point values of sufficiently large magnitude onto an Arduino String object. By passing values near the extremes of the float or double range to `String::concat(float)`, `String::concat(double)`, `String::operator+=()`, or the `+` operator with a float/double operand, `dtostrf()` writes beyond the fixed-size stack buffer, causing memory corruption and denial of service. Under specific conditions, this could enable arbitrary code execution on AVR-based Arduino boards. The fix is included starting from the `1.8.8 `release.

View the official NVD record for CVE-2026-48490

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.