Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-103436: apcupsd may reveal server memory contents via web pages

CVE-2026-103436 · published 19 days ago

Summary

The apcupsd program (up to version 3.14.14) used on Debian and related systems can accidentally include leftover memory data in the pages generated by its web interfaces. An attacker who visits those pages could see random information from the server, which might include sensitive details. Upgrade apcupsd to a newer release or disable the CGI web pages until a fix is applied.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	apcupsd	apcupsd	<= 3.14.14
Debian:12	debian	apcupsd	All versions
Ubuntu:16.04:LTS	canonical	apcupsd	All versions

Original advisory text

DEBIAN-CVE-2026-103436

apcupsd through 3.14.14 discloses uninitialized stack memory in getupsvar() in src/cgi/upsfetch.c (used by upsstats.cgi, multimon.cgi, and upsfstats.cgi. On the single-field path, when the matched STATUS line has fewer than three whitespace-separated tokens, sscanf("%*s %*s %s", answer) performs no assignment but the function returns success, and thus the caller prints the uninitialized destination buffer into the HTTP response.

References

https://bugzilla.redhat.com/show_bug.cgi?id=2493140 Third Party Advisory
https://github.com/therealbstern/apcupsd/blob/224d19d5faa508d04267f6135fe53d5080... Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2026-103436 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-1034... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-103436 Vendor Advisory
https://sourceforge.net/projects/apcupsd/ Third Party Advisory
https://ubuntu.com/security/CVE-2026-103436 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-103436 Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

3.7 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-457Use of Uninitialized Variable

Timeline

Published30 Sep 2026

Updated19 Oct 2026

First seen30 Sep 2026

Sources

CVE-2026-103436 · NVD

CVE-2026-103436 · MITRE

DEBIAN-CVE-2026-103436 · OSV

CVE-2026-103436 · OSV

UBUNTU-CVE-2026-103436 · OSV

Track software like this

Free during beta