Skip to main content
Apexward Pulse

Google · Memory corruption

Google Chromium WebP Heap-Based Buffer Overflow Vulnerability

CVE-2026-16436

What this means

This is rated critical severity (9.2 out of 10). There is no confirmed exploitation of it yet. Ask IT whether the affected products are in your estate.

Full vendor description

Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, MC Works64 all versions, GENESIS32 all versions, BizViz all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, GENESIS32 all versions, and BizViz all versions allows a remote attacker to unlock the system by obtaining the challenge response by some means. The challenge response used to unlock the system is common to all users and fixed. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.

Scoring and exploitation

9.2/ 10
CVSS 4.0 base scoreCritical

Exploitable over the network without any account, under specific conditions, and no one has to click or open anything. High impact on confidentiality, integrity and availability.

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Exploitability

Longer bar: easier to attack

Attack vectorNetworkAV:N
Attack complexityLowAC:L
Attack requirementsPresentAT:P
Privileges requiredNonePR:N
User interactionNoneUI:N

Impact

Longer bar: more harm

ConfidentialityHighVC:H
IntegrityHighVI:H
AvailabilityHighVA:H
~0.4% estimated chance of attack in 30 daysModel estimate (): a probability signal, not confirmed exploitation
Exploited in the wild
Not confirmed in the
Not reported

Weaknesses

CWE-640

References

3 links from the CVE record, grouped by site.

Related feed events

  • Google Chromium WebP Heap-Based Buffer Overflow Vulnerability

    Type Vulnerability

    A vulnerability in Google Chromium's WebP component could allow attackers to execute arbitrary code, bypass authentication, or cause system denial-of-service conditions.

    Next step: Confirm whether Google Chrome is in your estate.

    Who's reporting

    1 of 3 perspectives

    Official authority: Official 2Vendor statement missing. no VendorResearcher coverage missing. no Researcher2 signals

    Only official coverage so far. Treat as an early signal.

    Google ChromeMozilla FirefoxMozilla Thunderbird+2 moreAdvanced ManufacturingSaaS
    CVE-2023-4863+3