# CVE-2026-8764: H3C Magic B3 buffer overflow in UpdateWanParams

Source: https://junglewise.ai/threats/cve-2026-8764-h3c-magic-b3-buffer-overflow-in-updatewanparams  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-17. Updated: 2026-05-17  
License: CC BY 4.0 with a link back

CVE-2026-8764 · Severity: high · CVSS 7.2 · Published 2026-05-17

A security vulnerability exists in the H3C Magic B3 router, a device used to provide internet connectivity and network management. An attacker with administrative access can send a specially crafted request to the router's management interface to cause a system crash or potentially take full control of the device. This could lead to a total loss of internet service for the connected network or unauthorized access to network traffic.

Vendors: [H3C](https://junglewise.ai/threats/vendors/h3c).

## Quick answers

**Is CVE-2026-8764 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8764 being exploited in the wild.

**How severe is CVE-2026-8764?** High severity, with a CVSS score of 7.2, published 17 May 2026.

**Which products and versions are affected?** H3C Magic B3 up to 100R002.

**Is there a fix for CVE-2026-8764?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-8764 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-8764?** Check whether you run H3C Magic B3 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow vulnerability exists in the H3C Magic B3 router (firmware up to 100R002) within the 'UpdateWanParams' function of the '/goform/aspForm' interface. The root cause is an inconsistency between input validation and memory allocation: while the 'param' argument is restricted to 512 bytes, the subsequent copy operation targets a destination buffer of only 64 bytes without further bounds checking. An attacker with high privileges (authenticated administrator) can exploit this via a crafted POST request to overwrite adjacent memory. This can result in a crash of the web management service, a device reboot (DoS), or potentially remote code execution (RCE). As of the advisory date, the vendor has not responded to disclosure efforts, and no official patch is available.

## Affected products

- H3C Magic B3 up to 100R002

## Timeline

- 2026-04-23: disclosed: Vulnerability details and PoC published on GitHub
- 2026-05-17: advisory: CVE-2026-8764 published by VulDB/NVD

## References

- [https://github.com/yyyy0031/CVE/issues/1](https://github.com/yyyy0031/CVE/issues/1)
- [https://vuldb.com/submit/811373](https://vuldb.com/submit/811373)
- [https://vuldb.com/vuln/364389](https://vuldb.com/vuln/364389)
- [https://vuldb.com/vuln/364389/cti](https://vuldb.com/vuln/364389/cti)