µD3TN CVE-2026-121507

Exploitation requires the µD3TN node to process BPv6 (Bundle Protocol version 6) traffic that drives the fragmenter's block-duplication code path, AND a heap memory-allocation failure must occur at that exact point - the double free is reached only on allocation failure, per the description. The key limiting factor is this allocation-failure precondition: it is not directly attacker-controlled, which is why CVSS assigns AC:H; an attacker generally must first induce memory pressure/exhaustion on the target to make the failure likely. No authentication and no user interaction are required (PR:N/UI:N confirmed by the vector), and the node must be network-reachable (AV:N). Impact is limited to denial of service (daemon crash); there is no confidentiality or integrity impact.

This is a moderate-severity, availability-only issue (CVSS 5.9, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) - a CWE-415 double free in µD3TN's BPv6 fragmenter block-duplication path that an unauthenticated remote attacker can use to crash the node. The signals point to a real-but-not-urgent priority rather than a top-tier emergency: it is network-reachable and needs no authentication or user interaction (AV:N/PR:N/UI:N), but the high attack complexity (AC:H) reflects that the double free only occurs on an allocation failure, a condition the attacker cannot reliably control, and impact is confined to denial of service (C:N/I:N - no data exposure or code execution implied by the vector). The vuln.today decision label is 'this_month', consistent with a bug to patch on a normal cadence rather than immediately. No EPSS score was supplied, so exploitation probability cannot be quantified; there is no CISA KEV listing and no confirmed public exploit code, so there is no evidence of active exploitation. One data conflict must be flagged: the input Tags include 'Information Disclosure', which directly contradicts the CVSS vector (C:N/I:N/A:H) and the description - this is a denial-of-service/double-free bug, not an information-disclosure issue, and the tag appears mislabeled.

An attacker with network reach to a µD3TN node sends BPv6 bundles crafted to exercise the fragmenter's block-duplication code path; if a memory allocation fails at that point, the double free is triggered and the daemon crashes, denying DTN service. Because triggering depends on an allocation failure (AC:H), reliable exploitation typically also requires inducing memory pressure on the target, so it is not a trivially repeatable one-shot. No confirmed public exploit code was identified at the time of analysis.