← ASI Threat and Patch Database

ASI-2026-0012

HIGH FIXED CVSS: 8.1 Published: 2026-07-20

Description

In recv_record of tls.c, the 16-bit record-length field of an incoming TLS record is validated only against the generic TLS_RX_BUF constant (8192 bytes) rather than the actual capacity of the caller-supplied destination buffer. Two call sites in tls_connect(), used to receive the server's ChangeCipherSpec and Finished handshake messages, pass stack buffers of only 8 and 512 bytes respectively. A malicious or compromised TLS server can declare a record length up to 8192 bytes and have that many attacker-controlled bytes written past the end of either stack buffer, corrupting the stack of tls_connect()'s frame. This is reachable by initiating any outbound HTTPS connection (e.g. via wget) to a server under the attacker's control.

Affected Platforms

Artfical tOS < 0.9.116

Weakness Type

CWE-121, CWE-20

Discovered By

Artfical DT Developer Talha Berk Arslan

References