CVE-2026-12221: Yealink SIP-T46U Firmware Stack Buffer Overflow (CVSS 8.0)

Technical summary

The vulnerability resides in the sprintf function within the firmware chunk upload handler at /api/upgrade/upgrade. By manipulating the uid and start_offset parameters in upgrade requests, an authenticated attacker can overflow the stack buffer allocated for processing these values. This is a classic CWE-119 (improper restriction of operations within the bounds of a memory buffer) and CWE-121 (stack-based buffer overflow) issue. The attack surface is limited to the local network (AV:A in CVSS terms) and requires local authentication (PR:L), but once triggered, it grants high confidentiality, integrity, and availability impact—meaning potential code execution and system compromise.

Business impact

Compromised Yealink phones can be pivoted to eavesdrop on calls, inject malicious commands into call flows, or be used as a beachhead to attack other network infrastructure. For organizations relying on Yealink phones as part of their unified communications backbone, successful exploitation could disrupt operations, violate call confidentiality, and expose sensitive business conversations. The public availability of exploit code accelerates the timeline for opportunistic attacks within organizations sharing vulnerable device models on their networks.

Affected systems

Yealink SIP-T46U phones with firmware version 108.86.0.118 are confirmed vulnerable. Organizations should verify whether this exact firmware version is deployed; newer versions may also be affected pending vendor clarification, so contact Yealink support or check their security advisories for the full vulnerable version range and availability of patched firmware.

Exploitability

Exploitation requires network adjacency and valid local credentials, which constrains the attack to insider threats or compromised accounts on the local network segment. However, the public disclosure of exploit proof-of-concept significantly increases practical exploitability for any attacker with network access and valid authentication. The straightforward nature of the stack overflow and low attack complexity (AC:L) means that weaponization is straightforward once credentials are obtained.

Remediation

Yealink has been notified and is developing a patch. Organizations should contact Yealink support immediately to inquire about available firmware updates for the SIP-T46U and apply them as soon as testing is complete. In the interim, restrict network access to the /api/upgrade/upgrade endpoint through firewall rules or network segmentation, and monitor for suspicious upgrade requests. Consider disabling remote upgrade capabilities if not actively needed.

Patch guidance

Monitor Yealink's security advisory portal and contact their support team directly for patched firmware versions. When updates become available, test them in a lab environment using a subset of devices before wider deployment. Verify that the patched firmware version addresses CVE-2026-12221 explicitly. If patches are delayed, prioritize upgrading devices in high-risk locations (executive areas, sensitive departments) first while implementing compensating network controls.

Detection guidance

Monitor the /api/upgrade/upgrade endpoint for requests with unusual or oversized uid and start_offset parameter values. Log all upgrade requests and correlate them with device firmware versions. Watch for stack traces or process crashes on Yealink phones, which may indicate failed exploit attempts. Network-based detection should flag any upgrade traffic originating from untrusted sources or during unusual times. Consider deploying IDS/IPS rules targeting malformed upgrade chunk requests once vendors publish signatures.

Why prioritize this

This vulnerability merits prompt attention due to the combination of public exploit availability, high CVSS score (8.0), potential for code execution, and the sensitive nature of VoIP devices in network environments. While local network access is required, the presence of disclosed proof-of-concept code means the barrier to exploitation is low for any attacker who gains internal network access or compromised user credentials. The impact on call confidentiality and system integrity is substantial.

Risk score, explained

The CVSS 3.1 score of 8.0 (HIGH) reflects a stack-based buffer overflow with high impact across confidentiality, integrity, and availability. The attack vector is adjacent (AV:A), limiting exposure to the local network, and authentication is required (PR:L), both of which prevent a critical rating. However, the low attack complexity (AC:L), absence of user interaction (UI:N), and high impact across all three security properties (C:H/I:H/A:H) justify the HIGH severity. Public exploit disclosure elevates practical risk above the baseline score.

Frequently asked questions