Which versions of Sonic 3 A.I.R. are affected by EUVD-2026-53875?

Sonic 3 A.I.R.'s OxygenEngine contains a session hijacking vulnerability affecting all multiplayer game sessions through inadequate connection validation.

How to fix or mitigate EUVD-2026-53875?

Within 24 hours, identify all production Sonic 3 A.I.R. deployments with multiplayer functionality and map which are exposed to untrusted networks. Within 7 days, implement network-level controls including source IP validation at the firewall, packet filtering rules on game server infrastructure, and network segmentation restricting multiplayer traffic to verified client networks; simultaneously enable monitoring for anomalous connection terminations and message injection patterns. Within 30 days, establish vendor patch tracking for OxygenEngine releases and evaluate supplemental protections such as cryptographic per-packet validation or connection re-authentication mechanisms to reduce reliance on source address validation.

Sonic 3 A.I.R. EUVD-2026-53875

Q: What is the CVSS score of EUVD-2026-53875?

EUVD-2026-53875 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-66732 HIGH

Origin Validation Error (CWE-346)

2026-08-06 disclosure@vulncheck.com

GHSA-pcww-cvpx-6v39

Code Injection

8.3

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

8.3 HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.4 HIGH

On-path network observation required (AC:H); no authentication or user interaction needed; no confidentiality impact as traffic is already cleartext.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 06, 2026 - 13:32 vuln.today

Analysis Generated

Aug 06, 2026 - 13:32 vuln.today

CVE Published

Aug 06, 2026 - 13:18 cve.org

HIGH 8.3

DescriptionCVE.org

Sonic 3 A.I.R. before commit 2492d18 contains a missing source address validation vulnerability in ConnectionManager where established connections are resolved by a two-byte local connection handle alone without verifying that the datagram source address matches the registered remote address for the connection. An on-path attacker who can observe cleartext UDP traffic can inject arbitrary packets into any established session by forging the two-byte connection identifier, enabling session termination via TerminateConnectionPacket, arbitrary channel message forgery, and forged request responses without requiring IP address spoofing.

AnalysisAI

Session hijacking via missing source address validation in Sonic 3 A.I.R.'s OxygenEngine ConnectionManager allows an on-path network attacker to inject arbitrary UDP packets into any established multiplayer session. The flaw exists because established connections are resolved solely by a two-byte local connection handle with no verification that the packet's source address matches the registered remote address, enabling session termination, channel message forgery, and response spoofing without IP address spoofing. No public exploit or CISA KEV listing exists, but the CVSS 4.0 score of 8.3 (AC:H) reflects that network on-path positioning is required, limiting opportunistic mass exploitation.

Technical ContextAI

Sonic 3 A.I.R. is a fan-made reimplementation of Sonic 3 & Knuckles using the OxygenEngine (oxygen_netcore), which provides custom UDP-based multiplayer networking. The vulnerable code in NetConnection.cpp resolved incoming packets to an established connection using only a two-byte local connection handle, never validating that the datagram's source socket address matched the registered remote address for that connection. CWE-346 (Origin Validation Error) describes exactly this root cause: the system trusts a short identifier without confirming the claimed origin. The commit diff (2492d1882cd2) shows the fix adds a Murmur2_64 hash comparison of the full SocketAddress struct via receivedPacket.mSenderAddress.getHash() != getRemoteAddress().getHash(), dropping packets from unexpected senders. A secondary fix bounds the packet ID gap to 100, preventing potential resource exhaustion from artificially created sequence gaps in ReceivedPacketCache.

RemediationAI

Update Sonic 3 A.I.R. to any build incorporating commit 2492d1882cd2cf1cc1d7415729ce5c4fd686cd4f or later; the upstream fix is available at https://github.com/Eukaryot/sonic3air/commit/2492d1882cd2cf1cc1d7415729ce5c4fd686cd4f. No separately released patch version number was identified - the fix is currently a source commit rather than a tagged release, so users should build from or await a distribution that includes this commit. As a compensating control until patched, players should avoid multiplayer sessions on untrusted networks (public Wi-Fi, shared LAN segments) where an on-path attacker could observe UDP traffic, since the attack requires network visibility; this eliminates the attacker's ability to capture the connection handle. Disabling multiplayer functionality entirely is a conservative fallback with the trade-off of losing online features. There is no indication that server-side mitigations are available independently of the client fix.