High severity · published Aug 5, 2026
CVE-2026-71265
Domoticz MochadTCP Stack Buffer Overflow via MOCHAD_RFSEC strcpy()
7.5
CVSS
0.3%
EPSS
No
On KEV
Description
Domoticz's MochadTCP::MatchLine handler for MOCHAD_RFSEC messages (hardware/MochadTCP.cpp) copies network-received data from the up-to-1028-byte m_mochadbuffer into a fixed 50-byte stack buffer tempRFSECbuf using strcpy with no length check, across three separate code branches (DS10A/KR10A/MS10A device types).
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DO
domoticz · domoticz
0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-71265
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-71265
github.com
https://github.com/domoticz/domoticz
github.com
https://github.com/domoticz/domoticz/blob/master/hardware/MochadTCP.cpp
More from domoticz
9.8
CVE-2019-10664
Domoticz before 4.10578 allows SQL Injection via the idx parameter in CWebServer::GetFloorplanImage in WebServer.cpp
7.5
CVE-2019-10678
Domoticz before 4.10579 neglects to categorize \n and \r as insecure argument options
5.4
CVE-2026-75520
Domoticz: Missing authorization and path traversal in the udevices Lua parser handler
5.4
CVE-2019-15480
Domoticz 4.10717 has XSS via item.Name
4.8
CVE-2026-1001
Domoticz < 2026.1 Stored XSS via Hardware Configuration Endpoint