Hi,

The following vulnerability was published for nut.

CVE-2026-85068[0]:
| Network UPS Tools is a collection of programs which provide a common
| interface for monitoring and administering UPS, PDU and SCD
| hardware. From 2.4.2 through 2.8.5, ippon_command in
| drivers/blazer_usb.c partially initializes char tmp[64] with a short
| Megatec status query and then passes a fixed eight-byte chunk to
| usb_control_msg. A malicious firmware-controlled USB device
| presenting the Mustek Powermust VID 0x06da and Mustek Powermust PID
| 0x0003 matches blazer_usb_id, selects ippon_subdriver, and can
| receive the uninitialized trailing stack bytes during normal
| polling. The disclosure is bounded and read-only, requires physical
| or supply-chain access to the USB bus, and has no established
| integrity or availability impact. This issue is scheduled to be
| fixed in version 2.8.6.

https://github.com/networkupstools/nut/security/advisories/GHSA-fjxc-2vpv-mqc8
https://github.com/networkupstools/nut/pull/3529

Fixed by: https://github.com/networkupstools/nut/commit/30d56d4282f823949b40763d5c76461c7dd107b3


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-85068
https://www.cve.org/CVERecord?id=CVE-2026-85068

Please adjust the affected versions in the BTS as needed.