Nixpkgs security tracker

Permalink CVE-2026-82478

6.9 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): Low (L)
Vulnerable System Impact Integrity (VI): Low (L)
Vulnerable System Impact Availability (VA): Low (L)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Exploit Maturity (E): Not Defined (X)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
Modified Vulnerable System Impact Integrity (MVI): Low (L)
Modified Vulnerable System Impact Availability (MVA): Low (L)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)

created 2 weeks, 2 days ago Activity log

Created suggestion 2 weeks, 2 days ago

NASA Trick TCP Socket JSONVariableServerThread.cpp parse_request stack-based overflow

A vulnerability was determined in NASA Trick 19.6.0. This issue affects the function JSONVariableServerThread::parse_request of the file trick_source/sim_services/JSONVariableServer/JSONVariableServerThread.cpp of the component TCP Socket Handler. This manipulation causes stack-based buffer overflow. The attack is possible to be carried out remotely. The vendor was contacted early about this disclosure but did not respond in any way.

References

VDB-397028 | NASA Trick TCP Socket JSONVariableServerThread.cpp parse_request stack-based overflow technical-descriptionvdb-entry
VDB-397028 | CTI Indicators (IOB, IOC, IOA) permissions-requiredsignature
CVE-2026-82478 | CVE Analysis and Report third-party-advisory
Submit #888016 | NASA Trick 19.6.0 Buffer Overflow third-party-advisory
https://app.notion.com/p/Stack-based-Buffer-Overflow-in-NASA-Trick-JSONVariable… related

Affected products

Trick

==19.6.0

Matching in nixpkgs

pkgs.trickle

Lightweight userspace bandwidth shaper

nixos-unstable 1.07-unstable-2019-10-03
- nixpkgs-unstable 1.07-unstable-2019-10-03
- nixos-unstable-small 1.07-unstable-2019-10-03
nixos-26.05 1.07-unstable-2019-10-03
- nixos-26.05-small 1.07-unstable-2019-10-03
- nixpkgs-26.05-darwin 1.07-unstable-2019-10-03

pkgs.pdftricks

Simple, efficient application for small manipulations in PDF files using Ghostscript

nixos-unstable 0.4.1
- nixpkgs-unstable 0.4.1
- nixos-unstable-small 0.4.1
nixos-26.05 0.4.1
- nixos-26.05-small 0.4.1
- nixpkgs-26.05-darwin 0.4.1

pkgs.trickster

Reverse proxy cache and time series dashboard accelerator

nixos-unstable 1.1.5
- nixpkgs-unstable 1.1.5
- nixos-unstable-small 1.1.5
nixos-26.05 1.1.5
- nixos-26.05-small 1.1.5
- nixpkgs-26.05-darwin 1.1.5

pkgs.winetricks

Script to install DLLs needed to work around problems in Wine

nixos-unstable 20260125
- nixpkgs-unstable 20260125
- nixos-unstable-small 20260125
nixos-26.05 20260125
- nixos-26.05-small 20260125
- nixpkgs-26.05-darwin 20260125