Suricata IDS/IPS EUVD-2026-75755

Exploitation requires the ability to write or supply a rule file that Suricata loads during signature initialization or reload. This means an attacker must either have local write access to the Suricata rules directory (requiring a local user account with appropriate filesystem permissions), or must be able to inject a malicious rule into an external ruleset source that the Suricata instance automatically retrieves (e.g., a compromised threat-intel feed or pull-based update mechanism). The crash is triggered at rule-parsing time, not by sending network traffic to the monitored interface - a passive Suricata sensor cannot be exploited remotely via packet injection. Deployments that load only internally maintained rulesets and restrict filesystem access to the Suricata process owner are effectively unexploitable by external attackers.

The CVSS 3.1 base score of 3.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) accurately reflects the narrow exploitability of this issue. Attack vector is local, meaning an attacker must have access to the system where Suricata loads rules - typically a security appliance or server managed by the same security team. Privilege requirement is low (PR:L), consistent with needing write access to the rules directory or the ability to supply a malicious ruleset (e.g., via a compromised external threat-intel feed). There is no confidentiality or integrity impact; only availability is affected, and at the limited (A:L) level, suggesting a crash-on-load rather than full persistent service disruption. The real-world risk is further constrained by the fact that most Suricata deployments load only trusted, vendor-supplied or internally curated rulesets. An operator inadvertently importing a public ruleset containing a malformed frame rule, or an insider threat modifying rules, are the most plausible scenarios. EPSS data was not provided; given the local-only vector and low CVSS, probability of opportunistic exploitation is expected to be low.

An attacker with write access to the Suricata rules directory, or who has compromised an external ruleset source that the engine fetches automatically, plants a rule containing a mixed-case frame keyword such as 'Frame' or 'FRAME'. When Suricata reloads its signatures - for example, during a scheduled rule update - the parser triggers a heap buffer overflow, causing the process to crash. The IDS/IPS engine goes offline until manually restarted, creating a monitoring blind spot.