CVE-2026-87679: broadcom fabric_operating_system Heap-based Buffer Overflow

Vulnerability summary

CVE-2026-87679 is a high (CVSS 8.5) Heap-based Buffer Overflow vulnerability in broadcom fabric_operating_system. EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 28.3% of scored vulnerabilities.

Timeline

1. 08-10-2026
   PublishedVulnerability first disclosed.
2. 08-10-2026
   Last modifiedVulnerability information updated.

Description

When Brocade Fabric OS versions before 10.0.1 processes trunk configuration operations, the application parses user-supplied list strings into dynamically allocated heap arrays without enforcing boundary checks on the maximum allowable number of elements. An authenticated administrator can exploit this vulnerability via crafted REST API requests containing an excessive number of list delimiters, causing heap corruption that can result in service crash or arbitrary code execution.

• CWE-122Heap-based Buffer OverflowA heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().