Out-of-bounds read in Mini SNMP daemon - CVE-2026-59961
Published: September 2, 2026
Vulnerability identifier: #VU146782
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-59961
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information and cause a denial of service.
The vulnerability exists due to an out-of-bounds read caused by integer underflow in the SNMP request parser functions decode_oid(), decode_str(), and decode_ptr() when parsing a crafted SNMP request with an oversized ASN.1/BER length field. A remote attacker can send a specially crafted SNMP request to disclose sensitive information and cause a denial of service.
The OID or string field is parsed before the SNMP community string is checked, so no authentication is required.
Affected software
Mini SNMP daemon
How to mitigate CVE-2026-59961
Install security update from vendor's website.
Mini SNMP daemon - update to 1.7