CVE-2026-95104 BUFFALO INC. CVE debrief

Who should care

Defenders responsible for BUFFALO Wi-Fi products should assess exposure and potential for denial-of-service (DoS) conditions. This includes operators, platform administrators, vulnerability management teams, and security teams. They should verify exposure of BUFFALO Wi-Fi products to this vulnerability and assess the potential for denial-of-service (DoS) conditions. They should also monitor for crafted HTTP requests.

Why it matters

Defenders should prioritize verifying exposure of BUFFALO Wi-Fi products to this vulnerability and assess the potential for denial-of-service (DoS) conditions.

• Potential denial-of-service (DoS) conditions
• Verification of exposure required
• Monitoring for crafted HTTP requests necessary

Technical summary

A stack-based buffer overflow vulnerability exists in BUFFALO Wi-Fi products. A non-authenticated crafted HTTP request may cause a denial-of-service (DoS) condition. The vulnerability has a CVSS score of 8.7 and is considered HIGH severity. The affected products are BUFFALO Wi-Fi products, but the specific components or versions affected are not explicitly stated. The vulnerability class is a stack-based buffer overflow, which can be triggered by a crafted HTTP request. The likely technical impact is a denial-of-service condition. The source-grounded technical

Defensive priority

Defenders should prioritize verifying exposure of BUFFALO Wi-Fi products to this vulnerability and assess the potential for denial-of-service (DoS) conditions.

Recommended defensive actions

• Verify exposure of BUFFALO Wi-Fi products to this vulnerability
• Assess the potential for denial-of-service (DoS) conditions
• Monitor for crafted HTTP requests

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability, with a CVSS score of 8.7 and a HIGH severity rating. The CVE record was published on 2026-09-28T09:17:08.697Z and has not been modified since then. The official CVE Program record and NVD detail page provide source-provided CVE metadata and source-specific vulnerability assessment. However, the records do not provide explicit information about the affected products, components, or scope. Defenders should

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.