3proxy CVE-2026-109438

Exploitation requires the 3proxy SOCKS proxy to be running with the external-NAT option (-Ne) configured - this is a non-default deployment setting and is the single most important limiting factor. The attacker must be able to reach the SOCKS listener over the network and send a SOCKS4-path client probe that deliberately fails the SOCKS version check to trigger the uninitialized reply. No authentication is required (PR:N) and no user interaction is needed (UI:N), but without -Ne configured the vulnerable code path (overwriting sin from extNat) is not reached, so instances not using external NAT are not affected. Impact is limited to disclosure of a few high bytes of a userspace pointer (partial ASLR weakening), not full memory read.

This is a genuine but modest-priority issue. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) indicates a network-reachable, unauthenticated flaw, but two signals temper the risk: AT:P reflects a required attack precondition (the non-default external-NAT -Ne option must be configured), and the impact is limited to VC:L (low confidentiality) with no integrity or availability effect. The real-world outcome is an information leak - a few high bytes of a userspace pointer - that weakens ASLR rather than granting direct code execution or data theft; it is most useful as a building block within a larger exploit chain, not as a standalone compromise. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so there is no public exploit identified at time of analysis. A vendor fix is confirmed (commit 206c923), and the source diff corroborates the root cause (the sin structure was partially overwritten from extNat without first being initialized via getsockname when remsock was invalid). Net assessment: real but low-to-moderate priority - the dependence on a non-default configuration and the low-value, ASLR-weakening-only impact keep it well below the urgency of a high-CVSS network RCE.

An attacker who can reach a 3proxy SOCKS instance that is running with the external-NAT (-Ne) option opens a connection and sends a client probe crafted to fail the SOCKS version check. 3proxy's SOCKS4 reply path returns a reply built from an uninitialized sin structure, leaking stack bytes that include high bytes of a userspace pointer, which the attacker collects to defeat ASLR in a subsequent exploit. No public exploit was provided, and exploitation is low-complexity (AC:L) once the -Ne precondition is met.