CVE-2026-22904: Stack buffer overflow in multi-cookie parsing (CWE-121)
CVE-2026-22904 is a critical stack-based buffer overflow (CWE-121) caused by improper length handling when several cookie fields, including TRACKID, are parsed. According to the CNA record, an unauthenticated remote attacker can cause denial of service and possibly remote code execution. The affected products and versions are not identified in the sources consulted.
Overview
CVE-2026-22904 was published on 2026-02-09 and assigned by CERT@VDE, which lists the issue in advisory VDE-2026-004. The weakness is classified as CWE-121, a stack-based buffer overflow, and is triggered when several cookie fields, including TRACKID, are parsed without adequate length checks.
Impact
The CNA record describes two outcomes: denial of service and possible remote code execution. The CVSS 3.1 base score recorded by the CNA is 9.8 (critical), with network attack vector, no privileges required and no user interaction. Confidentiality, integrity and availability are all rated high.
Affected products and versions
The record does not list any affected product, version range or vendor name. The advisory at CERT@VDE VDE-2026-004 is the primary source to check for affected products, and it was not available as structured data in this record.
Exploitation status
The CISA Known Exploited Vulnerabilities catalog does not list this CVE. No confirmed exploitation appears in the sources consulted. The EPSS estimate recorded is a probability of 0.00629 with a percentile of 0.48732, which is a statistical forecast and not evidence of attacks.
Remediation and mitigation
- Identify whether your environment runs any product covered by advisory VDE-2026-004 and check the advisory for vendor-provided fixes or updates.
- Where no fix is available yet, limit network exposure of the affected services, especially any interface reachable from untrusted networks.
- Place affected web interfaces behind controls that restrict request header sizes and enforce sensible cookie length limits, as a temporary defensive measure.
- Follow the vendor guidance in the advisory for any configuration hardening.
Detection guidance
- Review web server and application logs for requests carrying unusually large or numerous cookie headers, particularly those including TRACKID.
- Monitor for service crashes, restarts or unexpected process terminations that could indicate memory corruption attempts.
- Alert on anomalous traffic to management or industrial web interfaces from untrusted sources.
Limitations of the available information
The record lacks affected product names, vendor identity, affected version ranges, fixed versions and workarounds. The EPSS date in the record is later than the publication date, so the score should be treated as a snapshot. Consult the CERT@VDE advisory and the vendor for complete details.
Frequently asked questions
What is CVE-2026-22904?
It is a critical stack-based buffer overflow (CWE-121) in how multiple cookie fields, including TRACKID, are parsed. The CNA record describes denial of service and possible remote code execution.
Does this CVE require authentication to exploit?
According to the CVSS data in the record, no privileges and no user interaction are required, and the attack vector is network.
Is this vulnerability known to be actively exploited?
It is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.
Which products are affected?
The record does not name the affected products or versions. Check advisory VDE-2026-004 from CERT@VDE for that information.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.