CVE-2026-12192 HIGH

CVE-2026-12192: GALAYOU Y4 Web Server buffer overflow

Vendor Galayou
Product Y4
Weakness CWE-120
Published June 14, 2026
Last update June 15, 2026

CVSS base score

8.7/10
Attack vector Adjacent
Attack complexity Low
Privileges required None
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability was determined in GALAYOU Y4 1.0.0. Impacted is an unknown function of the component Web Server. This manipulation causes buffer overflow. The attack is only possible within the local network. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Key dates

02Disclosure timeline

June 14, 2026 CVE published
June 15, 2026 Record updated