CVE-2026-26399
Medium · 5.3CVSS
5.3
EPSS
0.1%
Published
Apr 20, 2026
CISA due date
—
The record
A stack-use-after-return issue exists in the Arduino_Core_STM32 library prior to version 1.7.0. The pwm_start() function allocates a TIM_HandleTypeDef structure on the stack and passes its address to HAL initialization routines, where it is stored in a global timer handle registry. After the function returns, interrupt service routines may dereference this dangling pointer, resulting in memory corruption.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-34553 iccDEV provides a set of libraries and tools for working with ICC color management… CWE-562
- CVE-2026-3591 A use-after-return vulnerability exists in the `named` server when handling DNS queries… CWE-562
- CVE-2024-4418 A race condition leading to a stack use-after-free flaw was found in libvirt. CWE-562