CVE-2026-19508 RDK CVE debrief

Who should care

Organizations using RDK-B WebUI, security teams monitoring for potential exploitation, and developers responsible for maintaining RDK-B WebUI should be aware of this vulnerability and take necessary actions to mitigate it.

Technical summary

Heap-based buffer overflow in the multipart form-data parser in `jst_post.c` in RDK-B WebUI `rdkb-2025q4-kirkstone.04.10.26` allows a remote unauthenticated attacker to cause memory corruption and denial of service, and potentially execute arbitrary code, via a crafted multipart/form-data request. This vulnerability has a CVSS score of 9.8 and is considered CRITICAL. The vulnerability affects RDK-B WebUI, specifically version `rdkb-2025q4-kirkstone.04.10.26`, and involves a flaw in the handling of multipart/form-data requests that could lead to memory corruption, denial of service, and potentially arbitrary code execution. Organizations should review and apply vendor remediation for RDK-B WebUI, inventory affected systems, and monitor for suspicious activity.

Defensive priority

Critical vulnerability in RDK-B WebUI with potential for memory corruption, denial of service, and arbitrary code execution.

Recommended defensive actions

• Review and apply vendor remediation for RDK-B WebUI
• Inventory affected systems and monitor for suspicious activity
• Implement compensating controls to limit exposure
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

Official CVE Program record and NIST NVD detail page confirm vulnerability in RDK-B WebUI. Limited source detail available. The CVE record was published on 2026-08-19T20:17:14.647Z and has not been modified since then. Organizations should verify their exposure and review vendor guidance for remediation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.