---
id: "CVE-2026-121511"
kind: "vulnerability"
aliases: ["CVE-2026-121511"]
title: "\u00b5D3TN: integer wrap in fragmenter bounds check lets an external dispatcher read heap memory or crash the daemon"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "ud3tn", "fixed": ["0.15.2"], "affected": "< 0.15.2", "ecosystem": "vendor"}]
ecosystems: []
tags: ["bundle-protocol", "dtn", "embedded", "external-dispatch", "package", "\u00b5d3tn"]
not_affected_if: ["dispatcher-secret-set", "no-external-dispatch", "no-local-access"]
published_at: "2026-11-03T15:17:38+00:00"
first_seen_at: "2026-11-03T15:22:01+00:00"
updated_at: "2026-11-03T15:24:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121511", "first_seen_at": "2026-11-03T15:22:01+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T15:24:15+00:00"}]
---

# µD3TN: integer wrap in fragmenter bounds check lets an external dispatcher read heap memory or crash the daemon

The BPv6 and BPv7 fragmenters check fragment_offset + fragment_length against the payload length with uint64_t values, and the sum can wrap. An AAP 2.0 dispatcher that sends an offset near 2^64 makes the daemon read heap memory before the payload buffer and forward it to the next hop. A larger distance reads unmapped memory and terminates the process. The path exists only when µD3TN runs with --external-dispatch.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:ud3tn affected < 0.15.2 fixed 0.15.2

## How to check

Only daemons started with --external-dispatch (-d) are reachable. Check the service command line or unit file for that flag, and check the version with the ud3tn binary or your build tag (affected: below 0.15.2 per the CVE record). Also check whether the AAP 2.0 interface is reachable by untrusted local users and whether a dispatcher secret is set. Without a secret the interface accepts dispatcher connections without authentication.

## Fix

Upgrade µD3TN to 0.15.2 or later (the CVE record's fixed version). The upstream issue links the fix to MR !273 under milestone v0.16.0, so confirm your release contains the fragment.c bounds fix. Until then, don't use --external-dispatch, or set a dispatcher secret and restrict access to the AAP 2.0 socket/port.

## Timeline

- 2026-11-03T15:22:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121511
- 2026-11-03T15:24:15+00:00 analyst — Read upstream issue #290 (reporter PoC against v0.15.1, closed, fix in MR !273) and NVD CNA record (affected <0.15.2, fixed 0.15.2). Reachable only with --external-dispatch via AAP 2.0; triage's 'local' fits. Fix version not verified: issue says milestone v0.16.0, CNA says 0.15.2. No exploitation reports; PoC is in the issue text. Not searched X.

## Documents

- [advisory] Heap Out-of-Bounds Read in µD3TN BPv6/BPv7 Fragmenter (#290) https://gitlab.com/d3tn/ud3tn/-/work_items/290
- [describes] NVD record CVE-2026-121511 (CNA: GitLab, affected <0.15.2) https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-121511

## From the sources

Heap Out-of-Bounds Read in µD3TN BPv6/BPv7 Fragmenter allows Local Attacker to Read Memory and Reliably Cause DoS

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_