iperf3 EUVD-2026-90387

Requires a reachable iperf3 3.21 server running in server mode (iperf3 -s) accepting connections from the attacker; no authentication or user interaction is needed (PR:N/UI:N). The limiting factor is the race condition (AT:P): the attacker must cause a worker thread to remain blocked while the per-test watchdog timer (server_timer_proc) fires and frees the iperf_stream, so exploitation hinges on timing the attacker only partially controls, and success is not guaranteed on a single attempt. Only iperf3 servers exposed to untrusted networks are practically at risk; client-only or firewalled deployments are not.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H, 9.2) describes a remote, unauthenticated heap use-after-free with full impact to the vulnerable system, but the AT:P attack-requirement is the pivotal signal: exploitation depends on winning a timing race between the per-test watchdog (server_timer_proc) freeing an iperf_stream and a still-blocked worker thread dereferencing it. That race makes reliable exploitation nontrivial, and while any UAF is a candidate for code execution, the most dependable outcome against a network daemon is a server crash (denial of service); the VC:H/VI:H claims are aspirational for a UAF of this shape and not demonstrated. There is no EPSS score, no CISA KEV listing, and no public POC in the provided data, and the finding was self-reported by Anthropic rather than observed in the wild - so this is a credible, high-severity latent bug rather than an active threat. Priority is real for anyone exposing an iperf3 3.21 server to untrusted networks (unauthenticated + network reachable), but the race condition and absence of any exploitation evidence place realistic urgency below what the raw 9.2 would suggest.

An attacker reachable on the network connects as an unauthenticated iperf3 client to a running iperf3 3.21 server and initiates a test that spawns worker threads. By stalling a worker so it holds a reference to an iperf_stream while the server's per-test watchdog timer fires and frees that stream, the attacker triggers the blocked worker to dereference freed heap memory, crashing the server and potentially corrupting the heap. No public exploit code has been identified, and the AT:P attack requirement means the attacker must reliably win the free-versus-dereference race.