EUVD-2026-80658
GHSA-wggc-2fwv-g783
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Reachable only by an authenticated overlay peer so PR:L (not PR:N), crafting valid malformed fragments is hard so AC:H; impact is a transient process restart only, hence C:N/I:N/A:H.
Primary rating from Vendor (Arista).
CVSS VectorVendor: Arista
Lifecycle Timeline
7DescriptionCVE.org
The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated overlay neighbors. This vulnerability impacts the VeloCloud VCMP tunnel protocol only.
A successful exploit can cause the affected process to terminate and restart, leading to a temporary disruption of traffic. Hosts on the internet that are unauthenticated and unable to form an overlay peer relationship can not trigger the vulnerable logic.
AnalysisAI
An out-of-bounds write in Arista VeloCloud Edge and VeloCloud Gateway affects the VCMP tunnel protocol when it processes tunneled IP fragments, causing the affected process to crash and restart and briefly disrupting traffic on the affected SD-WAN node. Exploitation requires the attacker to already be an authenticated overlay neighbor with an established VCMP peer relationship to the target (assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) - internet hosts that are unauthenticated and cannot form an overlay peer relationship cannot reach the vulnerable logic. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to be an authenticated overlay neighbor that has successfully formed a VCMP-protocol peer relationship with the target VeloCloud Edge or Gateway; the description explicitly states unauthenticated internet hosts that cannot form an overlay peer relationship CANNOT trigger the vulnerable logic. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but bounded availability issue, not a critical remote-code-execution priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fixed VeloCloud Edge and VeloCloud Gateway software releases published in Arista Security Advisory 0180 (https://www.arista.com/en/support/advisories-notices/security-advisory/24736-security-advisory-0180); the exact patched version numbers are not specified in the provided intelligence, so confirm the target release against the advisory before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify every Arista VeloCloud Edge and VeloCloud Gateway instance in the estate, inventory all VCMP peer relationships, and disable or remove any peer not strictly required for business connectivity, since an authenticated overlay neighbor is a prerequisite for exploitation; simultaneously confirm redundant path or failover capacity so a node restart does not translate into a site outage. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today