Is CVE-2026-78116 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-78116 being exploited in the wild.

How severe is CVE-2026-78116?

Medium severity, with a CVSS score of 5.2, published 21 October 2026.

Which products and versions are affected?

Broadcom AFBR-S50 sensor driver releases before payload.Status check correction.

Is there a fix for CVE-2026-78116?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-78116 attacked?

It is attacked from the adjacent network, in device firmware.

Am I affected by CVE-2026-78116?

Check whether you run Broadcom AFBR-S50 sensor driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-78116: Broadcom AFBR-S50 sensor driver double-completion of RTIO submission

CVE-2026-78116 · Severity: medium · CVSS 5.2 · Published 2026-10-21

The Broadcom AFBR-S50 time-of-flight sensor driver used in embedded devices can be triggered by ambient light or sensor conditions to double-complete a data request, corrupting the system's submission queue and memory pools. This causes the device to write sensor data to already-freed memory buffers and deliver duplicate results to applications, leading to memory corruption and system instability or unavailability.

Vendors: Broadcom.

Quick answers

Is CVE-2026-78116 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-78116 being exploited in the wild.
How severe is CVE-2026-78116?: Medium severity, with a CVSS score of 5.2, published 21 October 2026.
Which products and versions are affected?: Broadcom AFBR-S50 sensor driver releases before payload.Status check correction.
Is there a fix for CVE-2026-78116?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-78116 attacked?: It is attacked from the adjacent network, in device firmware.
Am I affected by CVE-2026-78116?: Check whether you run Broadcom AFBR-S50 sensor driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a missing return statement in the error handling path of data_ready_work_handler() in the AFBR-S50 driver. When Argus_EvaluateData() fails, the function calls rtio_iodev_sqe_err() to complete the request but then falls through and calls rtio_iodev_sqe_ok() on the same submission, causing double-completion. Both calls invoke rtio_executor_done(), which frees the submission pool entry and releases RX buffers for streaming submissions, leading to corruption of the RTIO submission pool and subsequent writes through freed memory.

Affected products

Broadcom AFBR-S50 sensor driver releases before payload.Status check correction

Timeline

2026-10-21: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.