F5 BIG-IP CVE-2026-41956

UDP virtual server with classification profile enabled on F5 BIG-IP, BIG-IP Next CNF, or BIG-IP Next for Kubernetes. Classification profiles are advanced traffic analysis features not enabled by default on all virtual servers, requiring deliberate administrator configuration for application identification and policy enforcement. Exploitation requires network access to the UDP virtual server's listening address and port. Standard UDP virtual server deployments without classification profiles are not vulnerable. The specific request patterns that trigger the overflow are undisclosed by F5, limiting attacker knowledge but also defender testing capabilities.

The CVSS 7.5 (High) rating reflects maximum network exploitability (AV:N/AC:L/PR:N/UI:N) with complete availability impact (A:H). However, real-world risk is constrained by specific deployment requirements: exploitation only affects UDP virtual servers with classification profiles enabled, which is not a universal default configuration. The network-accessible attack vector and low complexity are concerning for internet-facing UDP services (DNS, SIP, RADIUS), but the attack surface is limited to organizations using F5's advanced traffic classification features on UDP protocols. No KEV listing or public exploit code identified, suggesting exploitation has not been observed in the wild. The stack overflow vulnerability class (CWE-121) is well-understood by attackers but typically requires protocol-specific expertise to weaponize. Priority should be elevated for organizations running UDP-based services with classification profiles on internet-facing BIG-IP systems, particularly DNS infrastructure and VoIP gateways. Organizations not using classification profiles on UDP virtual servers face minimal practical risk despite the high CVSS score.

An unauthenticated remote attacker identifies a BIG-IP virtual server configured to handle UDP traffic with a classification profile enabled, such as a DNS load balancer or SIP gateway. The attacker crafts malicious UDP packets containing payload patterns that trigger the stack buffer overflow in TMM's classification engine, causing immediate TMM process termination and resulting in denial of service for all traffic processed by that TMM instance, disrupting critical services for legitimate users.