CVE-2026-26399

CVE-2026-26399 is a stack-use-after-return vulnerability in Arduino_Core_STM32 library versions prior to 1.7.0, where the pwm_start() function improperly passes a stack-allocated structure pointer to HAL routines that store it globally. After the function returns, interrupt service routines may dereference this dangling pointer, leading to memory corruption and potential system instability. This vulnerability affects STM32-based Arduino systems that utilize PWM functionality. The vulnerability carries a CVSS score of 5.3 (Medium severity) with a local attack vector, low complexity, and low privilege requirements. While exploitation requires local access and user interaction is not needed, the impact is limited to low-level confidentiality, integrity, and availability violations. The EPSS score of 0.000150000 indicates this vulnerability is not prominently exploited relative to other CVEs, suggesting a lower real-world threat level. There is no active exploitation or public exploit code available for this vulnerability, and it has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The inactive status on security hot lists and minimal EPSS score indicate limited community attention and low exploitation activity. Users should prioritize patching to version 1.7.0 or later as part of routine maintenance rather than emergency response.