Yealink SIP-T46U Stack Overflow in Firmware Upload Goes Unpatched

A critical stack-based buffer overflow in the Yealink SIP-T46U phone firmware upload handler is now public as CVE-2026-12221, complete with an exploit and zero vendor response.

The Vulnerability: sprintf on the Stack

The flaw lives in the firmware chunk upload endpoint at /api/upgrade/upgrade. The function sprintf processes the arguments uid and start_offset into a stack buffer without bounds checking. A crafted sequence of chunks can overflow that buffer, corrupting adjacent memory. The overflow is exploitable for arbitrary code execution at the firmware level. Attackers don't need authentication; they just need to send malformed HTTP requests to the phone's upgrade API.

Attack Surface: Local Network, But Not Safe

Yealink SIP-T46U phones are common in enterprise desk-phone deployments, typically sitting on the same LAN as workstations and servers. The advisory marks the attack vector as "local network" meaning an attacker must be on the same broadcast domain or have direct routed access to the phone's IP. That's a realistic scenario: a compromised workstation, a rogue device plugged into an internal switch, or even a guest Wi-Fi network that shares the VLAN. Once inside the LAN, the exploit gives full control of the phone, turning it into a pivot point for lateral movement or a persistent foothold to eavesdrop on calls.

Vendor Silence and Enterprise Risk

Yealink was contacted before the disclosure but did not respond. No patch exists as of this writing. Public exploit code means any script kiddie with a basic understanding of HTTP can attempt the attack. For IT teams still running firmware 108.86.0.118 on their SIP-T46U fleets, the only mitigation right now is to isolate the phone VLAN from untrusted traffic and disable the upgrade API if not actively used.

Expect more targeted attacks against VoIP endpoints as attackers realize these devices often run unmonitored, unpatched firmware with open management interfaces.

Source: CVE-2026-12221 | Yealink SIP-T46U 108.86.0.118 Firmware Chunk Upload /api/upgrade/upgrade sprintf uid/start_offset stack-based overflow
Domain: vuldb.com