Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-66733

Sonic 3 A.I.R. Unbounded Memory Allocation DoS via ReceivedPacketCache

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Sonic 3 A.I.R. before commit 2492d18 contains an unbounded memory allocation vulnerability in ReceivedPacketCache::enqueuePacket() that allows unauthenticated remote attackers to crash the server process by sending a crafted UDP packet with mUniquePacketID set to the maximum uint32 value. The mUniquePacketID field is read directly from the UDP wire-format packet header without bounds checking, causing the server to allocate one CacheItem per missing packet ID gap, exhausting available host memory and propagating an uncaught std::bad_alloc exception to std::terminate().

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Eukaryot sonic3air

Default version status: affected

  • 0 to ≤ 26.03.28.0affected
  • 2492d1882cd2cf1cc1d7415729ce5c4fd686cd4funaffected
pkg:github/Eukaryot/sonic3air

References