https://blog.espilon.net/tags/libosdp/Recent content in LibOSDP on EspilonHugoenWed, 16 Sep 2026 00:00:00 +0000https://blog.espilon.net/posts/cve-2026-77273-77275-libosdp-osdp-oob/Wed, 16 Sep 2026 00:00:00 +0000https://blog.espilon.net/posts/cve-2026-77273-77275-libosdp-osdp-oob/Two flaws in LibOSDP, the open-source OSDP stack behind DIY and integrator badge-reader controllers. A CVSS 8.1 stack out-of-bounds write in the control-panel reply parser with attacker-controlled length and content, and a CVSS 6.5 out-of-bounds read in the file-transfer decoder. Both reachable pre-auth on the RS-485 bus. We take the write end to end to a hijacked control-panel program counter on unhardened embedded builds. Fixed in 3.2.4.