# CVE-2026-19386: ASUS router stack-based buffer overflow in configuration upload Source: https://junglewise.ai/threats/cve-2026-19386-a-stack-based-buffer-overflow-in-the-asus-router-modules-allows Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Published: 2026-10-07. Updated: 2026-10-07 License: CC BY 4.0 with a link back CVE-2026-19386 · Severity: info · Published 2026-10-07 ASUS routers are subject to a stack-based buffer overflow vulnerability in their configuration file upload functionality. An attacker with network access and knowledge of device credentials can exploit this by uploading a maliciously crafted configuration file, leading to arbitrary code execution on the router with full device privileges. Vendors: [ASUS](https://junglewise.ai/threats/vendors/asus). ## Quick answers **Is CVE-2026-19386 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19386 being exploited in the wild. **How severe is CVE-2026-19386?** Informational severity, published 7 October 2026. **Which products and versions are affected?** ASUS Router Modules . **Is there a fix for CVE-2026-19386?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it. **How is CVE-2026-19386 attacked?** It is attacked from the adjacent network or with local access, in device firmware. **Am I affected by CVE-2026-19386?** Check whether you run ASUS Router Modules at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you. ## Technical details A stack-based buffer overflow exists in ASUS router firmware modules when processing configuration file uploads. The vulnerability is triggered when a user-supplied configuration file exceeds the expected buffer size during upload. An authenticated attacker on the local network can craft a malicious configuration file to overflow the stack and execute arbitrary code with router privileges. ## Affected products - ASUS router modules ## Timeline - 2026-10-07: disclosed ## References - [https://www.asus.com/security-advisory](https://www.asus.com/security-advisory)