CVE-2026-67673 Details

A stack-based buffer overflow vulnerability has been identified in OreSat C3 Firmware version 1.0. The issue arises in the cmd_edl function when the edl fw_flash command is processed. The vulnerability occurs because the <filename> argument is copied into a 64-byte stack buffer using memcpy, without proper length validation. An attacker with physical access to the UART3 serial interface can exploit this vulnerability by sending a command with an oversized filename parameter, potentially leading to arbitrary code execution or a denial-of-service condition.

The vulnerability can be addressed by adding explicit length validation before all memcpy operations that involve user-supplied arguments in the cmd_edl function. After ensuring the filename length is within a safe range, the validated length can be used to copy the filename into the buffer, preventing the overflow. Additionally, the same bounds-checking pattern should be applied to other branches of the cmd_edl function that exhibit similar unvalidated copy patterns.