CVE-2026-19508

A heap-based buffer overflow in jst_post.c (multipart form-data parser) in RDK-B WebUI version rdkb-2025q4-kirkstone.04.10.26 allows a remote unauthenticated attacker to send a crafted multipart/form-data request, causing memory corruption, denial of service, and potentially arbitrary code execut...