Skip to content
OpenAdvisories
Medium · 5.3 Public exploit CVE-2026-26399 EUVD-2026-23912GHSA-vxch-4r45-jhw9

A stack-use-after-return issue exists in the Arduino_Core_STM32 library prior to version 1.7.0. The pwm_start() function allocates a TIM_Ha…

Published Apr 20, 2026 · Updated Apr 22, 2026 · Assigned by mitre

Package: arduino Ecosystem: Ubuntu

Description

A stack-use-after-return issue exists in the Arduino_Core_STM32 library prior to version 1.7.0. The pwm_start() function allocates a TIM_HandleTypeDef structure on the stack and passes its address to HAL initialization routines, where it is stored in a global timer handle registry. After the function returns, interrupt service routines may dereference this dangling pointer, resulting in memory corruption.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 arduino No fix yet —
Ubuntu 26.04 LTS arduino No fix yet —
Ubuntu 25.10 arduino No fix yet —
Ubuntu 24.04 LTS arduino No fix yet —
Ubuntu 22.04 LTS arduino No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS arduino No fix yet —
Ubuntu 18.04 LTS arduino No fix yet —
Ubuntu 16.04 LTS arduino No fix yet —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References