CVE-2026-38821

A heap-based buffer overflow vulnerability exists in openNDS before 11.0.0 that allows an...

7.1 High

A heap-based buffer overflow vulnerability exists in openNDS before 11.0.0 that allows an unauthenticated attacker on the captive portal network to crash the openNDS daemon (denial of service) and potentially achieve remote code execution. This is in http_microhttpd.c.

Attack profile

How easy it is to exploit

Attack vector: Adjacent network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: Low

Exploit likelihood

0.31%Up 0.1 points since Aug 28, 2026

What each source reports

CVE List Score used 7.1

Record: CVE-2026-38821
CVSS 3.1: 7.1 HighCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Weakness: CWE-122
Updated: 2026-11-02

EUVDEUVD-2026-67361 7.1

Record: EUVD-2026-67361
CVSS 3.1: 7.1 HighCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Updated: 2026-11-02

GitHub AdvisoriesGHSA-rm65-3jj4-3vcm 7.1

A heap-based buffer overflow vulnerability exists in openNDS before 11.0.0 that allows an...

Record: GHSA-rm65-3jj4-3vcm
CVSS 3.1: 7.1 HighCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Weakness: CWE-122
Updated: 2026-11-02

NVD 7.1

Record: CVE-2026-38821
CVSS 3.1: 7.1 HighCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Weakness: CWE-122
Updated: 2026-11-02

OSV 7.1

Record: CVE-2026-38821
CVSS 3.1: 7.1 HighCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Weakness: CWE-122
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-38821 7.1

Record: DEBIAN-CVE-2026-38821
CVSS 3.1: 7.1 HighCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-38821 7.1

Record: UBUNTU-CVE-2026-38821
CVSS 3.1: 7.1 HighCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Updated: 2026-11-02

Affected products

opennds

Affected packages

Affected packages
Package	Affected	Fixed
`opennds` Debian:12	All versions, plus listed versions 10.2.0+dfsg-110.3.0+dfsg-0.110.3.1+dfsg-19.10.0-1	None known
`opennds` Debian:13	All versions, plus listed versions 10.3.1+dfsg-1	None known
`opennds` Ubuntu:Pro:24.04:LTS	All versions, plus listed versions 9.10.0-110.2.0+dfsg-110.2.0+dfsg-1build110.2.0+dfsg-1build210.2.0+dfsg-1ubuntu0.24.04.1~esm1	None known
`opennds` Ubuntu:26.10	All versions, plus listed versions 10.3.1+dfsg-1build1	None known
`opennds` Ubuntu:26.04:LTS	All versions, plus listed versions 10.3.1+dfsg-110.3.1+dfsg-1build1	None known

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-38821 is a high vulnerability (CVSS 7.1) in Opennds, published August 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 23rd percentile. No source names a fixed version.