CVE-2025-26386: Johnson Controls Istar Configuration Utility Icu

High severity, CVSS 7.1. EPSS: 0.5% chance of exploitation in the next 30 days.

Johnson Controls iSTAR Configuration Utility (ICU) has Stack-based Buffer Overflow vulnerability. This issue affects iSTAR Configuration Utility (ICU) version 6.9.7 and prior. Successful exploitation of this vulnerability could result in failure within the operating system of the machine hosting the ICU tool.

Affected products

• Johnson Controls Istar Configuration Utility Icu: up to and including 6.9.7

Published 2026-01-28. Last modified 2026-06-17.