Live › vulnerability › CVE-2026-121510
µD3TN's BPv6 administrative record parser allocates source EID length + 1 bytes but a declared length of 0 makes its 16-bit counter underflow to 65535, so one unauthenticated bundle writes up to 65535 attacker-chosen bytes past a 1-byte heap buffer. The reporter reproduced a node crash; code execution is not excluded. A public PoC bundle is in the issue. Fixed in v0.15.2.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:22 UTC. All times on this page are UTC.
Any µD3TN node that accepts BPv6 bundles over the mtcp, smtcp or TCPCLv3 convergence layers. A single bundle addressed to the node's own node ID with the administrative-record flag and a zero-length source EID writes up to 65535 bytes past a 1-byte heap buffer before any agent or credential check, which crashes the node; the reporter says code execution cannot be excluded. Nodes whose convergence layers are not reachable by untrusted peers, or that run v0.15.2 or later, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| ud3tn | vendor | < 0.15.2 (lower bound not stated by the maintainer) | 0.15.2 |
v0.15.2v0.15.2 releaseUpgrade µD3TN to v0.15.2 (released 2026-10-26); the changelog lists this fix (#289) under Security.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Remote Unauthenticated Heap Out-of-Bounds Write in µD3TN BPv6 Administrative Record Parser allows Unauthenticated Remote Attacker to Reliably Cause DoS
This page as .md · .json · in your agent: get_signal("CVE-2026-121510")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.