EUVD-2026-29955
GHSA-f6vh-g7gh-wh6h
Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:A for adjacency requirement; AC:H for NAT64 configuration prerequisite; S:C because corrupted packets propagate to separate Thread mesh nodes beyond the border router.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Improper Input Validation in the NAT64 translator in The OpenThread Authors OpenThread before commit 26a882d on all platforms allows an attacker on the adjacent IPv4 network to inject corrupted IPv6 packets into the Thread mesh or bypass security checks via crafted IPv4 packets with options.
AnalysisAI
NAT64 translation in OpenThread (all platforms, before commit 26a882d) allows an unauthenticated attacker on the adjacent IPv4 network to inject corrupted IPv6 packets into a Thread mesh by exploiting missing IPv4 option validation. The root cause is that the translator stripped only the fixed 20-byte IPv4 header (sizeof(Ip4::Header)) rather than the actual header length derived from the IHL field, leaving raw option bytes - including LSRR and SSRR source-routing options - to be misinterpreted as upper-layer protocol payload in the translated IPv6 packet. No public exploit is identified at time of analysis; EPSS is 0.03% and SSVC indicates no current exploitation, consistent with the adjacency and NAT64-configuration prerequisites.
Technical ContextAI
OpenThread is an open-source implementation of the Thread IoT mesh networking protocol, maintained by The OpenThread Authors (originally Google). The affected component is the NAT64 translator (src/core/net/nat64_translator.cpp), which bridges an adjacent IPv4 segment to the Thread mesh over IPv6. CWE-20 (Improper Input Validation) manifests in two compounding failures visible in PR #12818: first, the IPv4 Header::IsValid() check did not enforce IHL ≥ 5 or that the computed header length did not exceed the total packet length, allowing malformed IHL values to pass; second, TranslateIp4ToIp6() called aMessage.RemoveHeader(sizeof(Ip4::Header)) - hardcoded to 20 bytes - rather than ip4Header.GetHeaderLength() (IHL × 4), so any packet with option fields left those bytes in the buffer, corrupting the resulting IPv6 payload. The fix introduces HasSourceRouteOption(), which parses the option list and rejects LSRR (type 131) and SSRR (type 137), and corrects the header-removal offset to use the actual computed header length. The CPE string cpe:2.3:a:the_openthread_authors:openthread:*:*:*:*:*:*:*:* covers all versions.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - apply commit 26a882d from https://github.com/openthread/openthread/pull/12818 and build from source, or monitor the OpenThread releases page for a tagged version that includes this commit. Until patched, the most targeted compensating control is deploying firewall rules on the border router's IPv4 interface to drop inbound packets with IP options set (i.e., IHL > 5); this is achievable via iptables with the '-m ipv4options' module or equivalent, at the trade-off of blocking legitimate but uncommon IPv4 options-bearing traffic. Alternatively, disabling NAT64 entirely (do not call SetEnabled(true)) eliminates exposure with no residual risk, at the cost of losing IPv4-to-Thread connectivity. Monitor https://nvd.nist.gov/vuln/detail/CVE-2026-8369 for confirmed patch version information.
More in Openthread
View allOpenThread wpantund through 2021-07-02 has a stack-based Buffer Overflow because of an inconsistency in the integer data
A memory leak in Openthread's wpantund versions up to commit 0e5d1601febb869f583e944785e5685c6c747be7, when used in an e
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today