CVE-2026-0826

The CVE-2026-0826 disclosure hedges with 'certain scenarios when admin has enabled ICE,' but this qualifier likely masks the real attack surface. ICE is not a feature users toggle for convenience — it's a foundational requirement for WebRTC NAT traversal in any production conferencing deployment. If your Poly device is configured for external collaboration, cross-domain federation, or basic WebRTC interop, ICE is enabled by default or by operational necessity. The 'certain scenarios' language is more plausibly a disclosure negotiation artifact than a genuine narrow condition. The buffer overflow lives in ICE candidate parsing — specifically when the stack processes remote SDP candidates containing IP addresses, ports, and transport parameters. A malformed candidate with oversized attributes can overwrite stack frames or heap headers, yielding RCE. This is a vulnerability class from the 1990s persisting in 2026 hardware, and the pattern is not accidental: STUN/TURN/ICE stacks across multiple vendors have shown continuous buffer conditions (CVE-2013-5211, CVE-2015-4421 through CVE-2017-11587) because teams treat NAT traversal as solved plumbing rather than attack surface requiring active memory-safety investment. The EPSS score of 0.24 — roughly a 1-in-4 chance of exploitation in 30 days — is elevated for conferencing hardware. This likely reflects either active reconnaissance of Poly infrastructure or credible exploit circulation in closed circles, not opportunistic scanning. The threat model for these devices is not random internet activity; it's targeted collection by nation-state teams and criminal groups pursuing corporate espionage. Three conditions make this more dangerous than the CVSS alone suggests. First, the signaling-versus-media plane split: ICE candidates are exchanged before DTLS-SRTP encryption is established, meaning candidate parsing occurs in a deliberately untrusted layer. Second, multiparty cascade: in a conference with multiple endpoints, one compromised participant can inject malformed candidates that propagate to every other device in the session. Third, physical adjacency: a compromised conferencing endpoint is a persistent beachhead in executive rooms, providing network proximity to call managers and identity infrastructure. Prioritize determining whether the vulnerable code lives in a shared STUN/TURN library (potentially affecting all libnice adopters) or was copy-pasted across product lines. If shared, one upstream fix resolves the entire ecosystem. If per-product, each firmware branch has a discrete patch timeline. In either case, treat this as a high-priority patch given the EPSS elevation and the realistic prerequisite of a compromised or malicious endpoint in the signaling path — a condition that enterprise federation makes routine.

Reviewed through automated stages and approved by a human before publication.