How do I check whether I am affected by CVE-2026-115678?

- Check the MDK-Middleware version in the project's pack files or Keil pack manager, e.g. look for `8.0.0` to `8.3.0` in the installed Arm.Keil pack version - Check whether the SNMP component of MDK-Middleware is included in firmware builds

What is the fix for CVE-2026-115678?

- Move MDK-Middleware to a version newer than `8.3.0` once Arm publishes a fixed release (unknown from sources) - Disable or remove the SNMP component if it is not needed

Who is not affected by CVE-2026-115678?

Not affected if: other-middleware-version, snmp-not-used.

Live › vulnerability › CVE-2026-115678

Go to dashboard

unknownPackage

Arm Keil MDK-Middleware: SNMP processing reads memory out of bounds before login

Arm Keil MDK-Middleware versions 8.0.0 through 8.3.0 may read memory past the end of a buffer while handling SNMP packets. The read happens before any authentication, so a remote sender could potentially leak memory contents.

Summary written from the sources below. Check the originals before acting.

Known so far

3/6

unknown

no CVSS yet; severity from the sources

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 26, 2026 UTC
Last modified: Oct 26, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-26 16:31 UTC. All times on this page are UTC.

Why it is unknown, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: No.
Needs a special setup: Yes.
Reachable from: network.
Worst case: Device memory contents may leak to a remote sender.
CVSS said: No score. The facts above say low; we keep the sources' unknown until an analyst looks.

Who is affected

Embedded firmware teams that build with Arm Keil MDK-Middleware 8.0.0 to 8.3.0 and ship the SNMP networking component on a device reachable over the network. Teams without SNMP enabled, or using other middleware versions, can skip it.

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-115678

Go to dashboard

unknownPackage

Arm Keil MDK-Middleware: SNMP processing reads memory out of bounds before login

Summary written from the sources below. Check the originals before acting.

Known so far

3/6

unknown

no CVSS yet; severity from the sources

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 26, 2026 UTC
Last modified: Oct 26, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-26 16:31 UTC. All times on this page are UTC.

Why it is unknown, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: No.
Needs a special setup: Yes.
Reachable from: network.
Worst case: Device memory contents may leak to a remote sender.
CVSS said: No score. The facts above say low; we keep the sources' unknown until an analyst looks.

Who is affected

Know the next one before it finds you.

Add to Slack

Arm Keil MDK-Middleware: SNMP processing reads memory out of bounds before login

Why it is unknown, and not just CVSS

Who is affected

Know the next one before it finds you.

Arm Keil MDK-Middleware: SNMP processing reads memory out of bounds before login

Why it is unknown, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources