# Unbounded copy into fixed buffer

Attacker-controlled length or scanset copied into fixed buffer without a bound check

_Area: Network devices and IoT. Seen in 4 disclosed reports; latest 2026-09-23. Updated 2026-10-24._

## How it works
A fixed-size buffer (stack, .bss global, or heap chunk) is filled by a copy routine whose length comes from the attacker, not the destination. The code assumes the input fits, or that a format specifier or string function is inherently safe. It is not: `strcat`, `memcpy`, `sprintf`, and scansets like `%[^-]` all copy until the source ends, not until the destination is full. The write runs past the buffer into whatever is adjacent — a stack frame, a global, a heap chunk header, or a function-pointer struct — and that adjacent data becomes the corruption target.

## Where it shows up
- Copy calls into fixed buffers where the length argument is derived from a request field, header, or parsed token [E1](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-youre-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452.md)[E3](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-is-this-a-joke-in-the-auth-header-f5-big-ip-unauth-heap-overflow-to-rce-cve-2026-94127.md).
- `strcat`/`strcpy`/`sprintf` building a string from repeated attacker tokens (element names, path segments) [E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-diving-deeper-into-watchguard-pre-auth-rce-cve-2022-26318.md).
- `sscanf`/`scanf` with scansets (`%[^-]`, `%s`) lacking a width limit, into small stack buffers [E4](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2025-02-11-exploitable-iot-html.md).
- SAML canonicalization attributes such as `InclusiveNamespaces PrefixList` that accept arbitrary unique tokens [E1](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-youre-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452.md).
- XML SAX callbacks appending element names to a global buffer [E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-diving-deeper-into-watchguard-pre-auth-rce-cve-2022-26318.md).
- Patch diffs adding new "too big" error strings or size checks around a copy [E1](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-youre-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452.md)[E3](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-is-this-a-joke-in-the-auth-header-f5-big-ip-unauth-heap-overflow-to-rce-cve-2026-94127.md).

## How to review
For every copy into a fixed buffer, trace the length back to its source. The invariant: the number of bytes written must be bounded by the destination size before the copy, on every path, including repeated appends. Check that scanset and `%s` conversions carry explicit widths, that string-building loops re-check remaining space, and that heap buffers are sized against the actual input length. When reviewing a patch, confirm the new check guards the copy itself, not a caller.

## Variants seen
- Heap overflow via oversized header copied into a fixed heap buffer, patched with a size bound [E3](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-is-this-a-joke-in-the-auth-header-f5-big-ip-unauth-heap-overflow-to-rce-cve-2026-94127.md).
- Global/.bss overflow via `strcat` of XML element names, corrupting an adjacent heap SAX handler struct [E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-diving-deeper-into-watchguard-pre-auth-rce-cve-2022-26318.md).
- Stack overflow via `sscanf` scanset without width into 32-byte buffers [E4](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2025-02-11-exploitable-iot-html.md).
- Canonicalization buffer overflow from attacker-controlled `PrefixList` tokens [E1](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-youre-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452.md).

## Impact and severity
All four reached pre-auth remote code execution as root or equivalent on network appliances [E1](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-youre-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452.md)[E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-diving-deeper-into-watchguard-pre-auth-rce-cve-2022-26318.md)[E3](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-is-this-a-joke-in-the-auth-header-f5-big-ip-unauth-heap-overflow-to-rce-cve-2026-94127.md)[E4](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2025-02-11-exploitable-iot-html.md). Severity is high because the services are unauthenticated and internet-facing. It worsens when the overflow lands next to function pointers or chunk headers, giving direct control-flow hijack [E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-diving-deeper-into-watchguard-pre-auth-rce-cve-2022-26318.md)[E3](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-is-this-a-joke-in-the-auth-header-f5-big-ip-unauth-heap-overflow-to-rce-cve-2026-94127.md), and when the device runs the service as root [E1](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-youre-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452.md)[E4](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2025-02-11-exploitable-iot-html.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-youre-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452.md
- E2: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-diving-deeper-into-watchguard-pre-auth-rce-cve-2022-26318.md
- E3: https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-is-this-a-joke-in-the-auth-header-f5-big-ip-unauth-heap-overflow-to-rce-cve-2026-94127.md
- E4: https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2025-02-11-exploitable-iot-html.md