CVE-2026-24832: ixray-team ixray-1.6-stcop Out-of-bounds Write Vulnerability
CVE-2026-24832 is an out-of-bounds write vulnerability (CWE-787) in the ixray-team ixray-1.6-stcop project, affecting versions before 1.3 according to the record. The CNA assigned a CVSS 3.1 base score of 9.8 (Critical) with network attack vector and no privileges or user interaction required. The sources consulted do not show confirmed exploitation, and the record lists no fixed version.
Overview
CVE-2026-24832 describes an out-of-bounds write (CWE-787) in the ixray-team ixray-1.6-stcop project. The record states that the issue affects versions before 1.3. The CVE was published on 2026-01-27 and is in the Analyzed status in the sources consulted.
Impact
An out-of-bounds write can corrupt memory adjacent to the intended buffer, which may lead to crashes or other unintended behavior. The CNA scored the issue at CVSS 3.1 9.8 (Critical), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates high potential impact to confidentiality, integrity and availability. The record does not describe the specific technical consequences, so the actual impact in a given deployment is not confirmed.
Affected products and versions
- Product listed in the record: Ixray-team Ix-ray Engine 1.6 (ixray-1.6-stcop).
- Affected range listed in the record: versions less than 1.3.
- The record does not list any fixed version.
The absence of a listed fix does not mean no fix exists. Check the project's repository and the third-party reference below for current information.
Exploitation status
The CISA KEV catalog does not list this CVE in the data available to this analysis, so no active exploitation is confirmed here. No confirmed exploitation appears in the sources consulted.
Remediation and mitigation
- Identify any deployment of the ixray-1.6-stcop project and determine whether its version is below 1.3.
- Review the upstream pull request referenced in the record, which is a third-party issue-tracking entry, to learn whether a corrective change is available.
- Upgrade to a version confirmed by the project maintainers as containing the fix. The record does not name that version.
- Where upgrading is not immediately possible, restrict network exposure of affected components and limit access to trusted users, as a general defensive measure.
Detection guidance
- Inventory software assets to find ixray-1.6-stcop builds and record their versions.
- Monitor for unexpected crashes or memory-related errors in services using this software, as these may indicate attempted abuse.
- Track updates from the project repository and the CVE record for changes to affected or fixed version information.
Limitations of the available information
The record provides a short English description, a CWE classification, a CVSS score from the CNA, and one third-party reference. It does not describe the vulnerable component, the trigger conditions, a proof of concept, a fixed version, or vendor advisory text. EPSS and SSVC data are unavailable. These gaps mean the exact exposure of any given system cannot be confirmed from the sources consulted.
Frequently asked questions
What is CVE-2026-24832?
It is an out-of-bounds write vulnerability (CWE-787) in the ixray-team ixray-1.6-stcop project, as described for versions before 1.3.
Is CVE-2026-24832 being actively exploited?
The CISA KEV catalog does not list it in the data available here, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.