µD3TN EUVD-2026-82978

Requires network reachability to a µD3TN v0.15.0 node running the TCP Convergence Layer version 3 (TCPCLv3) with its listener exposed; the attacker sends a crafted handshake whose length/size values trigger the CWE-190 integer overflow. No authentication and no user interaction are required (PR:N/UI:N), so any host that can reach the TCPCL port can attempt it. Limiting factors: exploitation only affects deployments that actually run TCPCLv3 (rather than other convergence layers or transports) and that expose the listener to the attacker's network, and impact is confined to availability (daemon crash) with no confidentiality or integrity effect and no code execution indicated.

The single strongest signal is the CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5), which describes a remote, unauthenticated, low-complexity condition with no user interaction and a pure availability impact (C:N/I:N/A:H) - consistent with the description of an integer overflow leading to a heap overflow that 'reliably' causes DoS during the TCPCLv3 handshake. No EPSS score, no CISA KEV listing, and no public exploit (POC) are provided in the intelligence, so this is 'no public exploit identified at time of analysis' and there is no evidence of active exploitation. No SSVC decision data is supplied. The realistic priority is therefore moderate-to-high on paper but tempered heavily by deployment footprint: µD3TN is a niche Delay/Disruption-Tolerant Networking (Bundle Protocol) implementation used mainly in space, research, and experimental networks, not general enterprise infrastructure, so the real-world blast radius is small despite the network-reachable unauthenticated vector. The vendor's word 'reliably' suggests a dependable crash primitive, which raises confidence in the DoS but there is no indication of code execution - impact is availability only, so this is a service-crash issue rather than an RCE. Key missing data: EPSS, KEV, POC, and an independently confirmed patched version are all absent; the sole reference is a GitLab work-item (issue tracker), not a formal advisory.

An attacker with network reachability to a µD3TN node's TCP Convergence Layer (TCPCLv3) listener initiates a handshake and sends crafted length/size fields that trigger the integer overflow, producing an undersized heap allocation and subsequent heap overflow that crashes the daemon. Because the vector is remote and unauthenticated (PR:N/UI:N) and the vendor states the DoS is triggered 'reliably', a single malformed handshake can repeatedly take the node offline. No public proof-of-concept is referenced at time of analysis.