Vulnerability · Published Aug 5, 2026 · Assigned by TuranSec

CVE-2026-71265Domoticz MochadTCP Stack Buffer Overflow via MOCHAD_RFSEC strcpy()

High 7.5

In plain English

A high-severity stack buffer overflow in domoticz from domoticz. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.3%top 78.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Domoticz's MochadTCP::MatchLine handler for MOCHAD_RFSEC messages (hardware/MochadTCP.cpp) copies network-received data from the up-to-1028-byte m_mochadbuffer into a fixed 50-byte stack buffer tempRFSECbuf using strcpy with no length check, across three separate code branches (DS10A/KR10A/MS10A device types).

Affected products (as reported)

Vendor	Product	Versions
domoticz	domoticz	0 – through *

Weakness: CWE-121 · Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/domoticz/domoticz third-party-advisory
https://github.com/domoticz/domoticz/blob/master/hardware/MochadTCP.cpp third-party-advisory