CVE-2026-9038 HIGH

CVE-2026-9038: Stack-based buffer overflow in XCharge C6

Vendor Xcharge
Product C6
Weakness CWE-121
Published May 28, 2026
Last update May 29, 2026

CVSS base score

8.6/10
Attack vector Physical
Attack complexity Low
Privileges required None
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

What the vulnerability does

01Description

A stack-based buffer overflow vulnerability in the charging controller’s signal-processing logic allows an attacker with physical access to the charging interface to supply message fields that exceed expected bounds. Because the input is not sufficiently validated, memory corruption may occur, which can lead to execution of unauthorized code with elevated privileges.

Key dates

02Disclosure timeline

May 28, 2026 CVE published
May 29, 2026 Record updated