CVE-2026-8362: Gladinet Triofox Stack-based Buffer Overflow in WOSDefaultHttpModule.dll

Synopsis

A stack-based buffer overflow exists in WOSDefaultHttpModule.dll, a component of Gladinet Triofox, triggered by sending a crafted HTTP request with an oversized URL path beginning with /woshome. The vulnerability is reachable over the network without any authentication or user interaction, based on the CVSS vector (AV:N/AC:L/PR:N/UI:N). Successful exploitation gives an attacker full read, write, and availability impact on the affected system, including the ability to execute arbitrary code. A patched-image rebuild at version 17.3.10565.57509 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Triofox service over the network; no local access or physical proximity is needed.

• AuthenticationNot required

  No credentials or account of any privilege level are needed to trigger the overflow.

• Victim interactionNot required

  The attacker sends a crafted HTTP request directly to the service; no user action is required.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special environmental conditions, race timing, or memory-layout knowledge.

Blast Radius

• An attacker can read any data accessible to the Triofox service process, including stored credentials, session tokens, and file content.
• An attacker can write or modify data handled by the service, including file system objects and configuration state.
• An attacker can crash the Triofox service or, more likely given the overflow class, execute arbitrary code with the privileges of the running process.
• If the Triofox process runs with elevated or SYSTEM-level privileges, full host compromise is within scope of a successful exploit.