µD3TN CVE-2026-121508

Exploitation requires the µD3TN node to be processing BPv6 bundles through its fragmenter, AND a memory allocation to fail during the fragmenter cleanup path - the allocation failure is the specific precondition that reaches the use-after-free (per the description's 'on Allocation Failure'). No authentication is required (PR:N) and the vector is network-based (AV:N), but the realistic limiter is that the attacker does not directly control whether an allocation fails; this is reflected in AC:H and means reliable triggering typically depends on the node being under memory pressure or otherwise resource-constrained. Impact is confined to availability (daemon crash/DoS); there is no confidentiality or integrity effect. Affected versions are not enumerated in the available data.

This is a moderate-severity availability issue (CVSS 5.9) rather than a top-tier emergency. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H indicates a network-reachable, unauthenticated flaw with no confidentiality or integrity impact - purely a denial-of-service on the availability axis - and a HIGH attack complexity, meaning the attacker cannot reliably trigger it on demand. The limiting signal here is the trigger condition: per the description the use-after-free fires specifically 'on Allocation Failure' during BPv6 fragmenter cleanup, i.e. the vulnerable path is reached only when a memory allocation fails, which is why AC:H is assigned. The vuln.today decision label is 'this_month' (not act_now/emergency), which is consistent with a real but non-urgent DoS. EPSS is not provided in the input, the CVE is not listed in CISA KEV, and no proof-of-concept or exploit code is indicated - so there is no evidence of active exploitation or weaponization. Net assessment: a genuine but bounded remote DoS against a niche product; worth patching on a normal cycle rather than treating as a drop-everything incident. Note the input 'Information Disclosure' tag conflicts with the CVSS impact (C:N) and the DoS-only description - treat the tag as suspect, not evidence of data exposure.

A remote, unauthenticated attacker sends BPv6 bundles to a reachable µD3TN node so that the bundle protocol agent performs fragmentation. If a memory allocation fails during the fragmenter cleanup path, a use-after-free is triggered that crashes or destabilizes the daemon, denying service to legitimate DTN traffic. The high attack complexity reflects that the attacker must coincide the malicious processing with an allocation-failure condition rather than triggering it at will; no public exploit code is identified in the provided data.