Description

INDI (Instrument Neutral Distributed Interface) indiserver through 2.2.4.2, fixed in commit 96bbd7f, contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to crash the daemon by sending malformed XML with mismatched tags whose names exceed 1024 bytes. Attackers can send a single TCP packet on port 7624 with mismatched XML tags to trigger an unbounded sprintf() write into a fixed 1024-byte stack buffer in MsgQueue.cpp, terminating the daemon and disrupting all active client and driver sessions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-17T18:18:12.370Z",
  "pubdate": "2026-08-17T18:18:12.370Z",
  "executiveSummary": "A stack buffer overflow vulnerability exists in indiserver through version 2.2.4.2, specifically within the MsgQueue.cpp component. The flaw allows unauthenticated remote attackers to cause a denial of service by transmitting malformed XML data containing mismatched tags with names exceeding 1024 bytes over TCP port 7624. Successful exploitation results in the abnormal termination of the indiserver daemon, immediately disrupting all active client and driver sessions connected to the service. The risk implication is significant for environments relying on continuous instrument control, as a single crafted TCP packet can induce complete service availability loss. No elevated privileges or prior authentication are required to execute the attack, lowering the barrier to exploitation across exposed network perimeters.",
  "technicalDetails": "The vulnerability resides in the MsgQueue.cpp file of indiserver through version 2.2.4.2, stemming from unsafe string manipulation routines processing incoming XML payloads. The root cause of the vulnerability is the utilization of an unbounded sprintf() function to write tag data into a fixed-size stack-allocated buffer restricted to 1024 bytes. When an unauthenticated remote attacker establishes a TCP connection to port 7624 and transmits a specially crafted network packet containing malformed XML with deliberately mismatched tags whose names exceed the 1024-byte boundary, bounds checking is omitted during the formatting operation. Consequently, excess data overflows the designated stack buffer, corrupting adjacent stack memory and triggering a segmentation fault or memory corruption exception that forcefully crashes the daemon. The attack flow requires minimal interaction: an attacker sends a single malicious TCP packet directly to the listening service port without needing valid session tokens, authentication credentials, or administrative privileges. The resulting post-exploitation impact is strictly localized to a denial of service, terminating all concurrent client control sessions and connected hardware drivers managed by the indiserver instance."
}