CVE-2026-123999 PUBLISHED

ION-DTN 3.6.2-4.2.0 Heap Buffer Overflow via nm_mgr AMP Rendering

Assigner: VulnCheck
Reserved: 06.11.2026 Published: 09.11.2026 Updated: 09.11.2026

NASA JPL ION-DTN 3.6.2 through 4.2.0 contains a heap-based buffer overflow in the Network Management daemon (nm_mgr) string-formatting logic that allows a malicious or misconfigured agent to trigger an out-of-bounds write by sending deeply nested AMP payloads that exceed fixed-size buffer allocations through unbounded strcat operations. Attackers can transmit oversized AMP reports, tables, or macros over the UDP CLA/AMP path or trigger the flaw locally via interactive UI rendering to crash nm_mgr and cause a denial of service halting telemetry collection and operator visibility.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS Score: 8.7

Product Status

Vendor nasa-jpl
Product ION-DTN
Versions Default: unaffected
  • affected from 3.6.2 to 4.2.0 (incl.)
  • Version 4.2.1-a.2 is unaffected

Credits

  • SecMate (secmate.dev) finder

References

Problem Types

  • Heap-based Buffer Overflow CWE