Domoticz's MochadTCP::MatchLine() handler for MOCHAD_RFSEC messages (hardware/MochadTCP.cpp) copies network-received data from the up-to-1028-byte m_mochadbuffe…

CVE-2026-71265 describes a critical stack-based buffer overflow vulnerability in Domoticz, an open-source home automation system. The vulnerability exists in the MochadTCP::MatchLine() function within hardware/MochadTCP.cpp, where network-received data from a up-to-1028-byte buffer (m_mochadbuffer) is copied into a fixed 50-byte stack buffer (tempRFSECbuf) using strcpy() without any length validation. This flaw affects three device type code branches: DS10A, KR10A, and MS10A. An unauthenticated attacker on the local network segment can exploit this by sending a crafted packet to the Mochad TCP bridge on default port 1099, overflowing the stack buffer by hundreds of bytes and corrupting the Domoticz worker thread's stack. Successful exploitation could lead to arbitrary code execution or denial of service. The lack of authentication on the default port significantly increases the risk of exploitation in typical deployments.