PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-26738 Uderzo CVE debrief

A buffer overflow vulnerability in Uderzo Software SpaceSniffer version 2.0.5.18 allows remote attackers to execute arbitrary code through a crafted .sns snapshot file. The vulnerability, classified as CWE-121 (Stack-based Buffer Overflow), requires local attack vector with user interaction, where an attacker must convince a victim to open a malicious file. The CVSS 3.1 score of 7.8 reflects high impacts to confidentiality, integrity, and availability. The CVE was published on March 10, 2026, and last modified on May 21, 2026. Third-party advisory information is available from Gruppo TIM's red team. No known exploitation in ransomware campaigns has been reported, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.

Vendor
Uderzo
Product
SpaceSniffer
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-10
Original CVE updated
2026-05-21
Advisory published
2026-03-10
Advisory updated
2026-05-21

Who should care

Security operations teams monitoring for file-based attacks, endpoint administrators managing disk visualization tools, and organizations using SpaceSniffer for storage analysis should prioritize awareness of this vulnerability due to its high severity and potential for complete system compromise through social engineering vectors.

Technical summary

SpaceSniffer 2.0.5.18 fails to properly validate input when parsing .sns snapshot files, resulting in a stack-based buffer overflow (CWE-121). The vulnerability is triggered when a user opens a maliciously crafted .sns file, allowing attacker-controlled code execution in the context of the application. The attack requires local access with user interaction (opening the file), but no privileges are required to trigger the vulnerability. The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates high impact across confidentiality, integrity, and availability domains once exploitation occurs.

Defensive priority

HIGH

Recommended defensive actions

  • Avoid opening .sns snapshot files from untrusted sources
  • Implement application whitelisting to prevent execution of unapproved software
  • Consider removing SpaceSniffer version 2.0.5.18 from endpoints where not essential
  • Monitor for suspicious .sns file attachments in email and web traffic
  • Review endpoint detection and response (EDR) policies for memory corruption indicators
  • Contact Uderzo Software for patch availability and upgrade guidance

Evidence notes

Buffer overflow confirmed via NVD CPE criteria cpe:2.3:a:uderzo:spacesniffer:2.0.5.18:*:*:*:*:*:*:*. CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates local attack vector requiring user interaction. CWE-121 (Stack-based Buffer Overflow) identified as weakness. Third-party advisory references provided by Gruppo TIM red team.

Official resources

The vulnerability was disclosed through MITRE and NVD with third-party advisory support from Gruppo TIM. The CVE record was published on March 10, 2026, and underwent modification on May 21, 2026.