A critical stack-based buffer overflow in NASA Trick 19.6.0 allows remote, unauthenticated attackers to trigger memory corruption and potential code execution.

This is a stack-based buffer overflow (CWE-121) located in the JSONVariableServerThread::parse_request function within the TCP Socket Handler component. An unauthenticated remote attacker can send a malicious JSON payload to this endpoint, triggering a memory corruption event that may lead to arbitrary code execution.

With a CVSS score of 7.3, this vulnerability represents a severe threat to systems running NASA Trick. Successful exploitation could allow an attacker to gain unauthorized control over the simulation environment, leading to data compromise, loss of system integrity, or complete system takeover. The potential for remote code execution makes this an urgent concern for security teams.

Immediate Action: Because the vendor has not provided a patch, restrict network access to the Trick JSONVariableServer component using firewalls or network segmentation to prevent external access.

Proactive Monitoring: Implement deep packet inspection on traffic directed toward the JSONVariableServer port to identify and block malformed JSON payloads or suspicious connection strings.

Compensating Controls: If the service is not required for production operations, disable the JSONVariableServer component entirely until a vendor-supplied security update is released.

Public Exploit Available: No

Given the lack of vendor response and the critical nature of a remote buffer overflow, immediate defensive measures are required. Organizations must isolate affected systems from public networks and monitor for any anomalous traffic directed at the JSONVariableServer component.