CVE-2025-28343 Overview
CVE-2025-28343 is a stack-based buffer overflow [CWE-121] in the striso-control-firmware project at commit 54c9722. The flaw resides in the ThreadReadButtons function, which handles button input processing on the Striso control board firmware. An attacker can trigger the overflow remotely without authentication or user interaction, causing the embedded device to crash and disrupting availability. The vulnerability does not expose data confidentiality or integrity but renders the affected firmware non-functional until restarted. The issue was published to the National Vulnerability Database on 2026-05-13.
Critical Impact
Remote attackers can crash the ThreadReadButtons thread in striso-control-firmware, producing a denial-of-service condition on affected embedded devices.
Affected Products
- striso-control-firmware at commit 54c9722
- Embedded devices running the vulnerable Striso control firmware build
- Downstream forks that inherit the unpatched ThreadReadButtons implementation
Discovery Timeline
- 2026-05-13 - CVE-2025-28343 published to NVD
- 2026-05-14 - Last updated in NVD database
Technical Details for CVE-2025-28343
Vulnerability Analysis
The vulnerability is a stack-based buffer overflow classified under [CWE-121]. It is triggered inside ThreadReadButtons, a function responsible for reading button state data on the Striso musical controller firmware. The function writes input-derived data into a fixed-size stack buffer without enforcing strict bounds, allowing adjacent stack memory to be corrupted when oversized input is processed.
The weakness only impacts availability. The CVSS vector indicates no confidentiality or integrity impact, consistent with a crash-only outcome on a constrained embedded target. Successful exploitation produces a thread fault and halts firmware execution until the device is reset.
Further technical context is documented in the GitHub Issue Report.
Root Cause
The root cause is missing or insufficient length validation on data written into a stack-allocated buffer inside ThreadReadButtons. The firmware assumes input from the button-handling routine remains within an expected size, but no boundary check enforces this assumption. When the size constraint is violated, the return address and adjacent locals on the stack are overwritten.
Attack Vector
The CVSS metadata reports a network attack vector with low complexity and no privileges required. An attacker who can deliver crafted input to the button-processing path can force the firmware thread to overflow its stack buffer and terminate. No authentication or user action is needed to reach the vulnerable function.
No public proof-of-concept exploit is currently listed, and the vulnerability is not in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.04%, reflecting low observed exploitation likelihood at this time.
Detection Methods for CVE-2025-28343
Indicators of Compromise
- Unexpected resets, hard faults, or watchdog reboots on Striso controller devices
- Crash logs referencing the ThreadReadButtons thread or stack corruption traps
- Repeated reconnects from a Striso device on the host or USB/serial bus following malformed input
Detection Strategies
- Review firmware crash dumps and trap handlers for stack canary violations near ThreadReadButtons
- Compare the deployed firmware build hash against commit 54c9722 to confirm exposure
- Instrument debug builds with stack guards or AddressSanitizer-equivalent tooling on the host emulator to surface overflow conditions during testing
Monitoring Recommendations
- Track device uptime and reboot frequency for Striso controllers to spot abnormal crash patterns
- Capture USB or serial traffic to the controller and alert on input frames exceeding expected button-event sizes
- Log firmware exception handler output through any available debug UART for offline analysis
How to Mitigate CVE-2025-28343
Immediate Actions Required
- Inventory all devices running striso-control-firmware and identify builds derived from commit 54c9722
- Restrict physical and network exposure of affected controllers until a fixed build is available
- Disable or isolate any host integrations that forward untrusted input to the button-reading path
Patch Information
No vendor patch is referenced in the NVD entry at publication time. Monitor the striso-control-firmware GitHub repository for upstream fixes and rebuild firmware from a commit that adds explicit bounds checking inside ThreadReadButtons. Until a tagged release is available, maintainers and integrators should apply a local patch that validates input length before copying data into the stack buffer.
Workarounds
- Rebuild firmware with compiler-level stack protection (-fstack-protector-strong) and overflow mitigations where the toolchain supports them
- Add an explicit length check at the entry of ThreadReadButtons to reject oversized button-event payloads
- Limit the firmware's exposure to untrusted upstream input sources until a verified fix is deployed
# Configuration example
# Rebuild striso-control-firmware with stack protection enabled
export CFLAGS="-fstack-protector-strong -Wstack-protector -D_FORTIFY_SOURCE=2"
make clean
make
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
