CVE-2026-26399

A stack-use-after-return issue exists in the Arduino_Core_STM32 library prior to version 1.7.0....

5.3 MediumPublic exploit

A stack-use-after-return issue exists in the Arduino_Core_STM32 library prior to version 1.7.0. The pwm_start() function allocates a TIM_HandleTypeDef structure on the stack and passes its address to HAL initialization routines, where it is stored in a global timer handle registry. After the function returns, interrupt service routines may dereference this dangling pointer, resulting in memory corruption.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: Low

Exploit likelihood

0.18%Up 0.2 points since Apr 21, 2026

What each source reports

CVE List Score used 5.3

Record: CVE-2026-26399
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-562
Updated: 2026-11-02

EUVDEUVD-2026-23912 5.3

Record: EUVD-2026-23912
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated: 2026-11-02

GitHub AdvisoriesGHSA-vxch-4r45-jhw9 5.3

A stack-use-after-return issue exists in the Arduino_Core_STM32 library prior to version 1.7.0....

Record: GHSA-vxch-4r45-jhw9
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-562, CWE-825
Updated: 2026-11-02

NVD 5.3

Record: CVE-2026-26399
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-562
Updated: 2026-11-02

OSV 5.3

Record: CVE-2026-26399
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-26399 5.3

Record: UBUNTU-CVE-2026-26399
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`arduino` Ubuntu:16.04:LTS	All versions, plus listed versions 2:1.0.5+dfsg2-4	None known
`arduino` Ubuntu:18.04:LTS	All versions, plus listed versions 2:1.0.5+dfsg2-4.1	None known
`arduino` Ubuntu:20.04:LTS	All versions, plus listed versions 2:1.0.5+dfsg2-4.1	None known
`arduino` Ubuntu:22.04:LTS	All versions, plus listed versions 2:1.8.15+dfsg1-12:1.8.16+dfsg1-12:1.8.18+dfsg1-12:1.8.19+dfsg1-1	None known
`arduino` Ubuntu:24.04:LTS	All versions, plus listed versions 2:1.8.19+dfsg1-2	None known
`arduino` Ubuntu:25.10	All versions, plus listed versions 2:1.8.19+dfsg1-32:1.8.19+dfsg1-4	None known
`arduino` Ubuntu:26.10	All versions, plus listed versions 2:1.8.19+dfsg1-5	None known
`arduino` Ubuntu:26.04:LTS	All versions, plus listed versions 2:1.8.19+dfsg1-42:1.8.19+dfsg1-5	None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	Acen28/CVE-2026-26399-Disclosure	2026-04-19

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-26399 is a medium vulnerability (CVSS 5.3) in arduino, published April 20, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 7th percentile. No source names a fixed version.