Is CVE-2026-106026 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-106026?

CVE-2026-106026 has a CVSS v3 severity of LOW (3.7).

Back

CVE-2026-106026

Description

tftp-hpa 5.4 before 6.0 contains an out-of-bounds read vulnerability in rewrite_string() in tftpd/remap.c that walks heap memory during jump label searches. Unauthenticated remote attackers can send read or write requests whose filename matches a remap jump rule to crash the forked in.tftpd request handler.