EUVD-2026-69796
GHSA-5vmj-4h65-2fh8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Single UDP packet, no auth, no interaction; primary impact is availability via crash or counter underflow; bounded nine-byte overread does not constitute meaningful confidentiality impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
5DescriptionCVE.org
ION-DTN versions before 4.2.0 contain an out-of-bounds read vulnerability in the decodeSdnv function that allows unauthenticated remote attackers to read memory by sending truncated SDNV values. Attackers can send a UDP datagram to the LTP link service input port with a truncated SDNV to trigger reads up to nine bytes past buffer boundaries and underflow byte counters.
AnalysisAI
Out-of-bounds read in ION-DTN's decodeSdnv() function before version 4.2.0 allows unauthenticated remote attackers to trigger reads up to nine bytes past buffer boundaries by sending a UDP datagram with a truncated SDNV to the LTP link service input port. The unbounded design of the original function - which consumed octets until finding one with a clear high-order bit - made it exploitable whenever all bytes in a truncated input retained the high-order bit set, simultaneously causing byte counter underflow. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The LTP link service UDP input port must be network-reachable by the attacker - the CVSS vector PR:N confirms no authentication is required, and no special non-default configuration is needed beyond running ION-DTN in its normal operational mode with the LTP convergence-layer adapter active. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, score 8.7) accurately reflects the attack profile: network-reachable via UDP, no authentication required, no complexity barriers, and a high availability impact on the vulnerable system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to ION-DTN 4.2.0, available at https://github.com/nasa-jpl/ION-DTN/releases/tag/ion-open-source-4.2.0, which replaces unbounded decodeSdnv() calls on untrusted input with the new bounds-checked decodeSdnvBounded() function across all affected call sites. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all ION-DTN deployments and confirm current version numbers; assess patch readiness and any operational constraints for your ground-station or network infrastructure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today