Vulnerability · Published Aug 7, 2026 · Assigned by NCSC.ch

CVE-2026-54209TeamDavid: Buffer Overflow in 'editini' function

High 8.9

In plain English

A high-severity out-of-bounds read in TeamDavid from Tobit Laboratories AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 4.0)8.9High

Exploit odds (30 days)0.4%top 64.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Tobit Laboratories AG TeamDavid's Webbox application handles password changes using a function triggered by including the string "(editini)" in the file path, writing the new password to the specified "Archive.ini" file. However, the application does not verify that the provided path actually refers to an "Archive.ini" file. If an attacker specifies a different file with excessive size, a buffer overflow occurs. This vulnerability allows an unauthenticated attacker to crash the server, resulting in denial of service. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.

Affected products (as reported)

Vendor	Product	Versions
Tobit Laboratories AG	TeamDavid	0 – before Rollout 528

Weakness: CWE-125 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

References

https://chayns.net/77892-10814/tapp/763210?postId=11454 release-notes
https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/ third-party-advisory