A vulnerability has been found in Yealink SIP-T46U 108.86.0.118 and classified as critical . This impacts the function sprintf of the file /api/upgrade/upgrade of the component Firmware Chunk Upload Handler . Performing a manipulation of the argument uid/start_offset results in stack-based buffer overflow. This vulnerability was named CVE-2026-12221 . The attack needs to be approached within the local network. In addition, an exploit is available. The vendor was contacted early about this disclo