CVE-2026-94127 Explained: F5 BIG-IP APM Heap Overflow Attack

Key Takeaways

• CVE-2026-94127 is an unauthenticated heap buffer overflow in F5 BIG-IP APM enabling remote code execution.
• The OAuth UserInfo handler allocates 0x4100 bytes but copies an attacker-controlled Authorization header without enforcing that limit.
• The overflow corrupts a neighboring callback pointer, enabling a stack pivot and a return-oriented programming chain.
• The chain appends a command to tmm.finish, which Bash runs after TMM crashes, bypassing SELinux restrictions.
• The Picus Platform lets teams simulate CVE-2026-94127 attacks to validate security controls against the exploitation.

CVE-2026-94127 is a heap-based buffer overflow in F5 BIG-IP Access Policy Manager (APM) that allows unauthenticated remote code execution. Exploitation requires network access to a virtual server configured with an APM access policy and an OAuth profile, with APM operating as an OAuth Authorization Server.

An attacker does not need an account, a valid access token, or an authenticated victim. An oversized Authorization header reaches an unsafe memory copy in the Traffic Management Microkernel (TMM).

This post explains how heap corruption becomes code execution and how to simulate this attack to test your security controls.

What Is CVE-2026-94127?

CVE-2026-94127 is a missing bounds check in the BIG-IP APM OAuth UserInfo handler that allows an attacker-controlled Authorization header to overflow a fixed heap buffer.

The handler allocates 0x4100 bytes but copies the header value without enforcing that limit. The demonstrated exploitation chain combines this overflow with callback-pointer corruption, return-oriented programming, and modification of a service lifecycle script to overcome SELinux execution restrictions [1].

How CVE-2026-94127 Works

CVE-2026-94127 works by copying an oversized HTTP header into a smaller heap allocation, allowing attacker-controlled bytes to corrupt adjacent memory.

1. An unauthenticated request reaches the OAuth UserInfo handler

An attacker reaches the vulnerable handler by sending a request to the OAuth UserInfo endpoint on an affected virtual server. The demonstrated path is /f5-oauth2/v1/userinfo, which is the default value of the OAuth profile's userinfo-url setting. Because that setting is configurable, a deployment can expose the handler at a different path.

The following abbreviated example sends an oversized Authorization header to the UserInfo endpoint [1]:

The repeated A bytes make the header value exceed the 0x4100-byte allocation, which is 16,640 bytes.

2. TMM extracts the header length and copies the value

TMM allocates a fixed buffer and obtains the copy length from parsed HTTP header metadata. The following decompiled statements allocate the buffer and calculate the header value length:

The handler copies v20 bytes into the 0x4100-byte buffer before checking the Bearer prefix. Here is the decompiled code:

Without a bounds check, any copied value longer than 0x4100 bytes overflows v8. The return-value comparison only checks the copied length, and the Bearer check runs after the overflow. For example, Bearer followed by 16,634 ASCII A bytes totals 0x4101 bytes and writes one byte past the buffer.

3. The overflow corrupts heap metadata or a neighboring callback

The oversized Authorization header writes past its allocated buffer and damages nearby memory, including the information TMM uses to manage allocations. When ufree() tries to release the corrupted allocation, an internal check fails and TMM crashes.

The same overflow also lets the attacker control what code TMM runs next. In the tested configuration, a nearby object sits at buffer + 0x4ff8 in about 90% of runs. It contains a callback pointer, a stored address telling TMM which function to call. The exploit replaces that address with one chosen by the attacker.

The following instructions show TMM reading the stored address and calling it [1]:

Normally, call r9 runs the function whose address is stored in the callback pointer. After the overwrite, it jumps to an address selected by the attacker. This gives the attacker control over which instructions TMM executes next.

The exploit then changes the stack pointer so TMM takes its next return addresses from a list prepared by the attacker. This is the stack pivot. Each address leads to a short sequence of instructions already present in the program. Linking these sequences forms a return-oriented programming (ROP) chain that arranges function arguments and calls existing functions, including open() and write() to modify a file.

4. The exploit executes a command through TMM's lifecycle script

The exploit executes a command by modifying /etc/bigstart/scripts/tmm.finish, which BIG-IP runs through Bash after TMM crashes. This avoids the SELinux restriction that blocks the ROP chain's attempt to launch /bin/sh through execvp().

First, the ROP chain calls open() and write() to add the command to the end of the script [1]:

When TMM then crashes, BIG-IP invokes the modified script with this:

Bash executes the attacker-controlled command in the modified script, completing the chain from an unauthenticated HTTP request to remote code execution (RCE).

How Picus Simulates CVE-2026-94127 Attacks?

We also strongly suggest simulating CVE-2026-94127 attacks to test the effectiveness of your security controls against real-life cyber attacks using the Picus Platform. You can also test your defenses against other vulnerability exploitation attacks, such as regreSSHion, Citrix Bleed, and Follina, within minutes with a 14-day free trial of the Picus Platform.

Picus Threat Library includes the following threats for the CVE-2026-94127 attacks:

Start simulating emerging threats today and get actionable mitigation insights with a 14-day free trial of the Picus Platform.

References

[1] S. Kheirkhah, "Is this a joke? In the auth header? (F5 BIG-IP unauth heap-overflow to RCE CVE-2026-94127)," watchTowr Labs, Sep. 23, 2026. Accessed: Sep. 24, 2026. [Online]. Available: https://labs.watchtowr.com/is-this-a-joke-in-the-auth-header-f5-big-ip-unauth-heap-overflow-to-rce-cve-2026-94127/