EUVD-2026-115831
GHSA-9v8h-435m-j59p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local low-privileged access
-
ExploitSubmit crafted bundle to BPv6/BPv7 fragmenter
-
ExecutionTrigger heap out-of-bounds read
-
ImpactLeak adjacent memory and crash daemon
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local access to a system running µD3TN plus existing low-level privileges (CVSS PR:L), and requires that the attacker's input reach the BPv6/BPv7 fragmentation code path - i.e., the product must be processing bundles through its fragmenter. The precise trigger (what malformed field or size causes the out-of-bounds read) is not described in the available sources. Limiting factors: no remote vector (AV:L), authentication/privilege is needed, and no user interaction is required (UI:N); there is no integrity impact, only memory disclosure (C:H) and reliable denial of service (A:H). |
| Impact | The input CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) scores 7.1 (High) and describes a local, authenticated (PR:L) attack with high confidentiality and availability impact but no integrity impact - consistent with a heap out-of-bounds read (CWE-125) that both discloses memory and crashes the process. The requirement for local access and existing low-level privileges materially lowers real-world urgency compared to a network-facing flaw. The vuln.today decision label is 'this_week' (not act_now/emergency), which aligns with a serious-but-not-critical local issue. No EPSS score is provided, so statistical exploitation likelihood cannot be quantified. The vulnerability is NOT in CISA KEV and there is no confirmed active exploitation. The only reference is the vendor's own GitLab work item (CVE.org source), which is an advisory/tracker entry, not verified working exploit code - no public exploit is identified. Overall this reads as a genuine but moderate-priority local DoS/info-leak in niche software, not a high-CVSS-but-illusory issue, yet also not an emergency: the local-access precondition is the dominant limiting factor. |
| Exploit ScenarioDerived | A local attacker who already has low-privileged access to a host running µD3TN supplies a crafted bundle that the BPv6/BPv7 fragmenter processes, triggering a heap out-of-bounds read. This lets the attacker read adjacent heap memory (potential disclosure of sensitive data) and reliably crash the µD3TN daemon, causing denial of service. No public exploit is identified at time of analysis; exploitation requires local access and low privileges per the CVSS vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Heap out-of-bounds read in µD3TN's BPv6/BPv7 fragmenter lets a local attacker with low privileges read process memory and reliably crash the bundle daemon (denial of service). A CVSS 3.1 vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H (7.1, High) applies: the attacker must already hold a foothold on the host and be able to get input into the fragmentation code path, but no user interaction is needed, confidentiality and availability impacts are high, and integrity is unaffected. The CPE for d3tn_gmbh:µD3TN carries wildcard version components, so the vulnerable version range is not narrowed in the available data; no public exploit code and no CISA KEV entry were identified at time of analysis, and the only reference is the upstream GitLab work item 290.
RemediationAI
No vendor-released patch or fixed version is identified in the available data, and the upstream GitLab work item (https://gitlab.com/d3tn/ud3tn/-/work_items/290) is the only reference provided, so patched builds cannot be confirmed at this time; monitor that work item and the project's release notes for a fix and apply it as soon as an exact version is published. No vendor-documented workaround is given in the sources either, so the practical compensating controls are operational rather than product features: restrict interactive and shell access to hosts running µD3TN so that only trusted accounts can reach the daemon's input path (reduces the AV:L/PR:L entry point but does not remove exposure for already-provisioned users), and run the µD3TN process under a dedicated least-privilege account with memory protections enabled so that a successful over-read has a narrower blast radius (this limits disclosure scope but does not prevent the crash). Because the integrity impact is nil and the availability impact comes from process termination, wrapping the daemon with a supervised restart policy can keep bundle forwarding alive after a crash, at the cost of losing in-flight state and generating repeated log noise rather than preventing the underlying denial of service.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
µD3TN (ud3tn) is D3TN GmbH's open-source implementation of Delay-Tolerant Networking, supporting both Bundle Protocol version 6 (BPv6) and version 7 (BPv7). The affected component is the fragmenter, the code that splits and processes bundle fragments, which means the flaw is reachable only when the daemon is actually handling bundles through that path - a plain deployment or one that never fragments would not exercise it. The root cause class is CWE-125, out-of-bounds read: a heap buffer is indexed or sized such that the code reads past its allocated end, which both leaks adjacent heap contents into observable output (C:H) and can fault the process (A:H), with no write-side or integrity effect (I:N). The supplied sources do not describe the specific malformed field, length value, or size arithmetic that triggers the over-read, so the precise trigger is not described in the available sources. The CVSS metrics (AV:L, PR:L) establish a local, low-privilege attacker rather than a remote one, but they describe severity and prerequisites, not the mechanism.
Know when D3Tn gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Local fragmenter input requiring existing low privileges gives AV:L/PR:L; out-of-bounds read discloses memory (C:H) and reliably crashes the daemon (A:H) with no integrity effect.
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
Lifecycle Timeline
2DescriptionCVE.org
Heap Out-of-Bounds Read in µD3TN BPv6/BPv7 Fragmenter allows Local Attacker to Read Memory and Reliably Cause DoS
Executive ViewAI
A high-severity vulnerability in the µD3TN bundle protocol daemon could allow a local attacker with existing low-level access to read sensitive process memory and cause a denial-of-service by crashing the daemon, potentially disrupting all delay-tolerant networking operations that depend on this software. This flaw affects the core fragmentation functionality and, while it requires an attacker to already have a foothold on the host, the confidentiality and availability impacts are rated High, making it a significant concern for any organization relying on µD3TN for critical communications. No patch is currently available, and no public exploit code has been identified, but the lack of a narrowed version range means all deployments should be considered at risk until further guidance is provided.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting local access to trusted users, enforcing least privilege, monitoring for abnormal daemon crashes or memory access patterns, and applying host-based hardening such as sandboxing and binary allowlisting to reduce the attack surface until a patch is available.
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Heap-based buffer overflow in the Space Packet Protocol (SPP) parser of µD3TN v0.15.1 allows an unauthenticated remote a
Memory exhaustion through amplified BPv6 EID reference handling in µD3TN can let remote attackers degrade or crash a net
An unauthenticated remote heap out-of-bounds write in µD3TN's Bundle Protocol version 6 (BPv6) administrative record par
µD3TN daemon crashes and denial of service can result from a use-after-free in the Bundle Protocol version 6 (BPv6) frag
Denial of service in µD3TN allows an unauthenticated, remote sender of BPv6 (Bundle Protocol version 6) traffic to crash
Exploit-DB