---
id: "CVE-2026-121510"
kind: "vulnerability"
aliases: ["CVE-2026-121510"]
title: "\u00b5D3TN BPv6 admin record parser: remote heap write causes denial of service"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "ud3tn", "fixed": ["0.15.2"], "affected": "< 0.15.2 (lower bound not stated by the maintainer)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["bpv6", "delay-tolerant-networking", "heap-overflow", "network-reachable", "other", "ud3tn", "unauthenticated"]
not_affected_if: ["cla-not-exposed", "v0.15.2-or-later"]
published_at: "2026-11-03T15:17:38+00:00"
first_seen_at: "2026-11-03T15:22:01+00:00"
updated_at: "2026-11-03T15:26:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121510", "first_seen_at": "2026-11-03T15:22:01+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T15:26:28+00:00"}]
---

# µD3TN BPv6 admin record parser: remote heap write causes denial of service

µD3TN's BPv6 administrative record parser allocates source EID length + 1 bytes but a declared length of 0 makes its 16-bit counter underflow to 65535, so one unauthenticated bundle writes up to 65535 attacker-chosen bytes past a 1-byte heap buffer. The reporter reproduced a node crash; code execution is not excluded. A public PoC bundle is in the issue. Fixed in v0.15.2.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:ud3tn affected < 0.15.2 (lower bound not stated by the maintainer) fixed 0.15.2

## How to check

Run your µD3TN build's version (or git tag) and confirm it is v0.15.2 or later; anything older is affected per the CVE record. You are exposed only if the node listens on a mtcp, smtcp or TCPCLv3 convergence layer reachable by untrusted peers. Also check any BPv6 deployment built from master before the v0.15.2 release.

## Fix

Upgrade µD3TN to v0.15.2 (released 2026-10-26); the changelog lists this fix (#289) under Security.

## Timeline

- 2026-11-03T15:22:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121510
- 2026-11-03T15:26:28+00:00 analyst — Read issue #289 (reporter's text, PoC bytes included) and vendor CHANGELOG (v0.15.2 fixes #289). Affected lower bound not stated; '<0.15.2' comes from the CNA record via OffSeq (secondary). No exploitation reported; PoC public in the issue, so poc link set. Severity unchanged. Not searched X (obscure project).

## Documents

- [advisory] µD3TN issue #289: Heap OOB write in BPv6 admin record parser https://gitlab.com/d3tn/ud3tn/-/work_items/289
- [fix] µD3TN CHANGELOG (v0.15.2 security fixes) https://gitlab.com/d3tn/ud3tn/-/raw/master/CHANGELOG.md
- [poc] µD3TN issue #289: Heap OOB write in BPv6 admin record parser https://gitlab.com/d3tn/ud3tn/-/work_items/289

## From the sources

Remote Unauthenticated Heap Out-of-Bounds Write in µD3TN BPv6 Administrative Record Parser allows Unauthenticated Remote Attacker to Reliably Cause DoS

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_