Which versions of Sonic 3 A.I.R. are affected by EUVD-2026-53876?

Sonic 3 A.I.R. multiplayer services face an unpatched availability risk: attackers can crash the game server from any internet-connected position without credentials using a single network packet,…

How to fix or mitigate EUVD-2026-53876?

Within 24 hours, identify all systems running Sonic 3 A.I.R. and assess whether they are affected; if running vulnerable versions, implement immediate UDP traffic filtering at the network perimeter or take multiplayer servers offline to prevent exploitation. Within 7 days, establish continuous monitoring of the upstream vendor's security advisories for patch releases, and implement network-level rate limiting on UDP ports to defend against packet injection attacks. Within 30 days, develop a comprehensive patch deployment plan for when Sonic 3 A.I.R. releases a fix, conduct load-balancer testing to ensure failover capabilities minimize downtime, and consider architectural changes such as UDP packet validation layers or multi-region failover to reduce single-server DoS impact.

Sonic 3 A.I.R. EUVD-2026-53876

Q: What is the CVSS score of EUVD-2026-53876?

EUVD-2026-53876 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

| CVE-2026-66733 HIGH

Memory Allocation with Excessive Size Value (CWE-789)

2026-08-06 disclosure@vulncheck.com

GHSA-947v-gcqq-82hv

Denial Of Service

8.7

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-reachable with no auth and no complexity; single packet causes full availability loss with no C/I impact and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 06, 2026 - 13:32 vuln.today

Analysis Generated

Aug 06, 2026 - 13:32 vuln.today

CVE Published

Aug 06, 2026 - 13:18 cve.org

HIGH 8.7

DescriptionCVE.org

Sonic 3 A.I.R. before commit 2492d18 contains an unbounded memory allocation vulnerability in ReceivedPacketCache::enqueuePacket() that allows unauthenticated remote attackers to crash the server process by sending a crafted UDP packet with mUniquePacketID set to the maximum uint32 value. The mUniquePacketID field is read directly from the UDP wire-format packet header without bounds checking, causing the server to allocate one CacheItem per missing packet ID gap, exhausting available host memory and propagating an uncaught std::bad_alloc exception to std::terminate().

AnalysisAI

Memory exhaustion denial-of-service in Sonic 3 A.I.R.'s UDP networking stack allows unauthenticated remote attackers to crash the multiplayer server process with a single crafted packet. The root cause is in ReceivedPacketCache::enqueuePacket() within the OxygenEngine netcore layer: the mUniquePacketID field is read directly from the UDP wire format without bounds validation, and when set to UINT32_MAX the server attempts to allocate one CacheItem per missing packet ID gap, exhausting host memory until an uncaught std::bad_alloc propagates to std::terminate(). No public exploit code and no CISA KEV listing exist at time of analysis, but the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H, score 8.7) reflects that the attack is trivially automatable from any network-reachable position.

Technical ContextAI

Sonic 3 A.I.R. (Sonic 3: Angel Island Revisited) is an open-source fan remaster built on the OxygenEngine, which includes an oxygen_netcore UDP networking layer for multiplayer. ReceivedPacketCache tracks in-flight packets by a uint32 mUniquePacketID field read directly from the wire-format UDP header. When a packet arrives with an ID far ahead of the last-seen sequence number, the cache fills the intervening gap with placeholder CacheItem allocations to support out-of-order delivery. Before commit 2492d18, no upper bound existed on this gap: an attacker setting mUniquePacketID to 0xFFFFFFFF (~4.29 billion) would trigger allocation of up to ~4.29 billion CacheItems, consuming all available host memory. CWE-789 (Uncontrolled Memory Allocation) precisely describes this root cause - attacker-controlled packet data directly governs heap allocation magnitude without sanitization. The fix in commit 2492d1882cd2cf1cc1d7415729ce5c4fd686cd4f adds a hard gap-size cap of 100 entries and introduces sender address hash validation to drop spoofed-source packets.

RemediationAI

Update Sonic 3 A.I.R. to a build that includes upstream commit 2492d1882cd2cf1cc1d7415729ce5c4fd686cd4f or any subsequent release incorporating it; this is the only confirmed fix. The commit applies two mitigations: a gap-size cap in ReceivedPacketCache::enqueuePacket() that rejects any packet whose ID gap exceeds 100 entries (returning false immediately), and a sender address hash check in NetConnection.cpp that silently drops packets whose source IP and port do not match the established connection's stored remote address. For operators unable to immediately rebuild from source, a compensating control is to restrict UDP access to the server's listening port to trusted IP ranges via host or network firewall - this narrows the attacker pool to trusted peers but does not eliminate the vulnerability for those peers and has no gameplay side effects. Generic 'defense in depth' controls such as rate limiting UDP packets per source IP may reduce exploit speed but will not prevent a determined single-source attack. No formal versioned release or vendor advisory URL beyond the VulnCheck report and the GitHub commit is available.