Cyber Resilience

CVE-2026-24827

High

Published: 27 January 2026

Published
27 January 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0008 23.1th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-24827 is a high-severity Out-of-bounds Write (CWE-787) vulnerability. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 23.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Deeper analysis

CVE-2026-24827 is an Out-of-bounds Write vulnerability (CWE-787) in gerstrong Commander-Genius. This issue affects Commander-Genius versions before the release at refs/pull/358/merge.

The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). A remote, unauthenticated attacker can exploit it over the network with low attack complexity and no user interaction required. Successful exploitation leads to high availability impact, such as denial-of-service through application crashes, with no effects on confidentiality or integrity.

Mitigation details are available in the GitHub pull request at https://github.com/gerstrong/Commander-Genius/pull/379. Security practitioners should consult this reference for patching guidance.

EU & UK References

Vulnerability details

Out-of-bounds Write vulnerability in gerstrong Commander-Genius.This issue affects Commander-Genius: before Release refs/pull/358/merge.

CWE(s)
CWE-787

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

Out-of-bounds write (CWE-787) with AV:N and confirmed A:H impact enables remote exploitation that directly crashes the target application, matching T1499.004 (Application or System Exploitation) for Endpoint Denial of Service.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2024-24422Shared CWE-787
CVE-2026-41989Shared CWE-787
CVE-2025-13151Shared CWE-787
CVE-2020-37208Shared CWE-787
CVE-2026-43656Shared CWE-787
CVE-2025-24326Shared CWE-787
CVE-2021-47786Shared CWE-787
CVE-2019-25478Shared CWE-787
CVE-2026-27853Shared CWE-787
CVE-2024-13168Shared CWE-787

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly remediates the out-of-bounds write vulnerability by requiring timely patching to the fixed version referenced in the GitHub pull request.

SI-16 Memory Protection good match
prevent

Implements memory protections such as address space layout randomization and write protection to prevent unauthorized memory writes from out-of-bounds accesses.

SI-10 Information Input Validation good match
prevent

Validates inputs to the Commander-Genius application to block malformed data that triggers the out-of-bounds write leading to denial-of-service.

References