CVE-2026-13489

Description

A weakness has been identified in 78 xiaozhi-esp32 up to 2.2.6. Affected by this issue is the function ParseMessage of the file main/mcp_server.cc of the component MCP Response Handler. This manipulation causes improper synchronization. Remote exploitation of the attack is possible. The attack's complexity is rated as high. The exploitation is known to be difficult. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.

CVSS v3.1 Score

3.1

LOW

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS — Exploit Prediction

0.0023

Probability of exploitation

0.14%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-662 CWE-662

References

Other References

https://github.com/78/xiaozhi-esp32/ https://github.com/78/xiaozhi-esp32/issues/2020 https://github.com/78/xiaozhi-esp32/pull/2021 https://vuldb.com/cve/CVE-2026-13489 https://vuldb.com/submit/838198 https://vuldb.com/vuln/374486 https://vuldb.com/vuln/374486/cti

Frequently Asked Questions

What is CVE-2026-13489? +

A weakness has been identified in 78 xiaozhi-esp32 up to 2.2.6. Affected by this issue is the function ParseMessage of the file main/mcp_server.cc of the component MCP Response Handler. This manipulation causes improper synchronization. Remote exploitation of the attack is possible. The attack's complexity is rated as high. The exploitation is known to be difficult. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance. It has a CVSS v3.1 base score of 3.1 (LOW).

How severe is CVE-2026-13489? +

CVE-2026-13489 has a CVSS v3.1 score of 3.1 out of 10, rated LOW. This is a low-severity vulnerability with limited impact. The EPSS score is 0.0023, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-13489? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-32644 9.1

Evmos is a scalable, high-throughput Proof-of-Stake EVM blockchain that is fully compatible and interoperable with Ethereum. Prior to 17.0.0, there …

CVE-2025-27104 7.5

vyper is a Pythonic Smart Contract Language for the EVM. Multiple evaluation of a single expression is possible in the …

CVE-2024-7409 7.5

A flaw was found in the QEMU NBD Server. This vulnerability allows a denial of service (DoS) attack via improper …

CVE-2024-30387 6.5

A Missing Synchronization vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on ACX5448 and ACX710 allows …

CVE-2021-46939 5.5

In the Linux kernel, the following vulnerability has been resolved: tracing: Restructure trace_clock_global() to never block It was reported that …

CVE-2024-58131 4.0

FISCO BCOS 3.11.0 has an issue with synchronization of the transaction pool that can, for example, be observed when a …