CVE-2026-8363: Gladinet Triofox Stack-based Buffer Overflow in WOSDeviceDropFolder.dll

Synopsis

A stack-based buffer overflow exists in WOSDeviceDropFolder.dll, a component of Gladinet Triofox, triggered by sending an oversized URL path beginning with /resources to the service over the network. The flaw requires no authentication and no user interaction, making it directly reachable by any attacker who can connect to the exposed service. Successful exploitation gives the attacker full control over the affected host, including the ability to read, modify, or destroy data and execute arbitrary code. A patched-image rebuild at version 17.3.10565.57509 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Triofox service over the network; any internet- or LAN-exposed instance is in scope.

• AuthenticationNot required

  No credentials or session token of any kind are needed to trigger the overflow.

• Victim interactionNot required

  The attacker sends a crafted HTTP request directly; no user on the target system needs to take any action.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, memory-layout guessing, or special environmental state is required.

Blast Radius

• Attacker can execute arbitrary code at the privilege level of the Triofox service process, effectively owning the host.
• All data accessible to the service, including stored files, credentials, and session material, can be read and exfiltrated.
• An attacker can modify or delete files and configuration managed by Triofox, corrupting stored data or altering service behavior.
• The service process can be crashed or made unresponsive, denying access to all connected users and dependent workflows.