Eclipse tinydtls CVE-2026-9267

No authentication is required - the vulnerability is triggered during DTLS epoch 0, the unencrypted pre-authentication handshake phase, before any session credentials are established. No user interaction is required. No special non-default configuration is needed; any tinydtls deployment that accepts inbound DTLS connections and processes Certificate handshake messages is affected. Both client and server code paths are vulnerable, meaning a malicious server can also exploit a tinydtls client during handshake. Exploitation is limited by: (1) the attacker must have UDP network access to the target's DTLS port; (2) the target must be running an unpatched tinydtls version; (3) impact is availability-only per the CVSS 4.0 vector (VA:L, VC:N, VI:N), though the Information Disclosure tag suggests potential memory exposure that may not be fully captured in the current CVSS assessment.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N, score 6.9) reflects a network-reachable, zero-interaction, unauthenticated path with low availability impact and no confidentiality or integrity impact on the vulnerable system. However, the 'Information Disclosure' tag conflicts with VC:N - CWE-125 OOB reads on constrained devices can expose adjacent heap or stack memory to an attacker, suggesting confidentiality impact may have been underweighted or was deliberately scoped out; this discrepancy should be verified against the fix commit diff. EPSS data was not provided, so exploitation probability cannot be quantified numerically. No CISA KEV listing and no POC code have been identified, placing this in the low-urgency tier despite its clean attack vector. On memory-constrained embedded targets (the tinydtls deployment context), even a 'low' availability impact may mean a full device crash or reboot rather than merely degraded performance, which amplifies real-world operational risk in IoT deployments. No SSVC data was provided; inferred SSVC exploitation status is 'none' given absence of KEV and POC.

An attacker with network access to a DTLS-enabled tinydtls endpoint initiates a DTLS handshake during epoch 0 and sends a crafted Certificate handshake message in which the fragment_length field is set to a value exceeding the actual buffer size. The check_server_certificate() function reads the uint24 value and proceeds to memcmp or memcpy operations without validating buffer bounds, triggering an out-of-bounds read that corrupts or reads adjacent memory, causing the memory-constrained target device to crash or become unresponsive. No exploit code is publicly known, but the attack requires only standard DTLS socket access and a single crafted packet, making it low-effort to reproduce from the description alone.