{"id":"CVE-2026-115679","kind":"vulnerability","aliases":["CVE-2026-115679"],"related":[],"title":"Arm Keil MDK-Middleware FTP server: out-of-bounds read and write in RX buffer","description":"Arm Keil MDK-Middleware 8.3.0 may allow out-of-bounds reads and writes to the FTP Server RX Buffer","summary":"Arm Keil MDK-Middleware 8.3.0 has a flaw that may allow out-of-bounds reads and writes to the FTP Server RX buffer. The sources do not say what an attacker can achieve beyond memory corruption.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["arm-keil","embedded","ftp-server","mdk-middleware","other"],"not_affected_if":["ftp-server-unused"],"how_to_check":"- Check whether the project uses Arm Keil MDK-Middleware and which version is in use, for example in the pack list of the Keil MDK project; the affected version is `8.3.0`\n- unknown","fix":"- Move to a fixed MDK-Middleware release; unknown which version fixes it, check the Arm advisory\n- unknown","status":"open","published_at":"2026-10-26T16:17:17+00:00","first_seen_at":"2026-10-26T16:31:01+00:00","triaged_at":"2026-10-26T16:33:13+00:00","updated_at":"2026-10-26T16:33:13+00:00","category":"other","confidence":0.3,"triage":{"at":"2026-10-26T16:33:13Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a fixed MDK-Middleware release; unknown which version fixes it, check the Arm advisory\n- unknown","reach":"unknown","title":"Arm Keil MDK-Middleware FTP server: out-of-bounds read and write in RX buffer","impact":"medium","summary":"Arm Keil MDK-Middleware 8.3.0 has a flaw that may allow out-of-bounds reads and writes to the FTP Server RX buffer. The sources do not say what an attacker can achieve beyond memory corruption.","category":"other","nicknames":[],"who_cares":["embedded","arm-keil","mdk-middleware","ftp-server"],"confidence":0.3,"needs_auth":"unknown","worst_case":"unknown; memory corruption in the FTP server RX buffer","analyst_note":"Check the NVD entry and the Arm security advisory for the trigger, attack vector, CVSS score and fixed version of MDK-Middleware.","how_to_check":"- Check whether the project uses Arm Keil MDK-Middleware and which version is in use, for example in the pack list of the Keil MDK project; the affected version is `8.3.0`\n- unknown","needs_analyst":true,"not_affected_if":["ftp-server-unused"],"who_is_affected":"Embedded projects built with Arm Keil MDK-Middleware 8.3.0 that enable its FTP Server component are the ones the description points to. Projects that do not use the FTP server or use a different middleware version are likely not affected. unknown beyond that, as the sources do not say how the flaw is triggered.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00062,"input_tokens":3270,"output_tokens":586,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-115679':20A,23A '-2026':19A,22A '8.3.0':39B,77C 'achiev':68B 'allow':45B,79C 'arm':1A,25B,34B,72C 'arm-keil':24B 'attack':66B 'beyond':69B 'bound':11A,49B,83C 'buffer':17A,58B,92C 'corrupt':71B 'cve':18A,21A 'embed':27B 'flaw':42B 'ftp':6A,29B,55B,89C 'ftp-server':28B 'keil':2A,26B,35B,73C 'may':44B,78C 'mdk':4A,32B,37B,75C 'mdk-middlewar':3A,31B,36B,74C 'memori':70B 'middlewar':5A,33B,38B,76C 'out-of-bound':8A,46B,80C 'read':12A,50B,84C 'rx':16A,57B,91C 'say':63B 'server':7A,30B,56B,90C 'sourc':60B 'write':14A,52B,86C","nicknames":[],"mitigations":[],"who_affected":"Embedded projects built with Arm Keil MDK-Middleware 8.3.0 that enable its FTP Server component are the ones the description points to. Projects that do not use the FTP server or use a different middleware version are likely not affected. unknown beyond that, as the sources do not say how the flaw is triggered.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T16:17:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115679","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115679","severity":null,"published_at":"2026-10-26T16:17:17+00:00","modified_at":"2026-10-26T16:17:17+00:00","first_seen_at":"2026-10-26T16:31:01+00:00","fetched_at":"2026-10-26T16:31:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}