Is CVE-2026-4010 actively exploited?

No active exploitation of CVE-2026-4010 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-4010 be exploited remotely?

No. CVE-2026-4010 requires local access to exploit.

What is the CVSS score of CVE-2026-4010?

CVE-2026-4010 has a CVSS score of 3.3 (LOW).

HOME VULNERABILITIESCVE-2026-4010

LOW

CVE-2026-4010

CWE-119Published: March 12, 2026· Updated: Mar 12, 2026

3.3

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:3.0th

Official Description

A vulnerability was found in ThakeeNathees pocketlang up to cc73ca61b113d48ee130d837a7a8b145e41de5ce. The affected element is the function pkByteBufferAddString. The manipulation of the argument length with the input 4294967290 results in memory corruption. The attack requires a local approach. The exploit has been made public and could be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

NVD Source

Technical Analysis

CVE-2026-4010 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

From a weakness classification perspective (CWE-119): Buffer overflow vulnerabilities can lead to arbitrary code execution or denial of service by corrupting adjacent memory.