ntop nDPI EUVD-2026-110492

nDPI must be actively inspecting network traffic, and the targeted flow must already be classified by nDPI as SoftEther before the trigger packet is sent. The attacker then sends a crafted short/truncated SoftEther UDP datagram so that the consumed byte count used by strncmp exceeds the actual payload length, causing a read beyond the packet buffer in dissect_softether_host_fqdn(). No authentication and no user interaction are required (PR:N/UI:N per the CVSS 4.0 vector). The key limiting factor is the precondition that a SoftEther flow must already exist and be classified on the monitored segment, which constrains purely opportunistic exploitation; impact is limited to availability (process crash/instability) of the DPI engine, not data disclosure or code execution.

The signals point to a moderate, bounded risk rather than a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) shows a remotely reachable, low-complexity, unauthenticated trigger, which raises the base to 6.9, but the only impact metric set is VA:L - the out-of-bounds read affects availability in a limited way (potential crash/instability of the DPI engine) with VC:N and VI:N, so there is no confidentiality or integrity impact per the vendor vector. This tempers the 'network/unauthenticated' alarm: the worst realistic outcome is a denial-of-service of the monitoring process, not code execution or data theft. EPSS is low at 0.43% (37th percentile) and the CVE is not listed in CISA KEV, consistent with no confirmed active exploitation. The vuln.today decision label is 'this_month', indicating a routine-but-prompt patch priority rather than act_now/emergency. Note a tension to verify: the 'Information Disclosure' tag conflicts with the CVSS VC:N (no confidentiality impact) - the flaw is a CWE-125 out-of-bounds read whose comparison result is not returned to the attacker, so it does not disclose data to a remote party; treat the 'Information Disclosure' labeling as questionable. A public PoC reference (hackmd write-up) exists but is not verified as working exploit code, so PoC availability must not be read as active exploitation.

An attacker able to put traffic on a network segment inspected by nDPI first ensures a flow is classified as SoftEther, then sends a crafted short/truncated SoftEther UDP datagram on that already-classified flow. Because dissect_softether_host_fqdn() passes the consumed byte count instead of the actual data length to strncmp, the comparison reads past the packet payload buffer, risking a crash or instability of the monitoring process. A public PoC reference exists; it is not verified as working exploit code.