CVE-2026-66732
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Sonic 3 A.I.R. before commit 2492d18 contains a missing source address validation vulnerability in ConnectionManager where established connections are resolved by a two-byte local connection handle alone without verifying that the datagram source address matches the registered remote address for the connection. An on-path attacker who can observe cleartext UDP traffic can inject arbitrary packets into any established session by forging the two-byte connection identifier, enabling session termination via TerminateConnectionPacket, arbitrary channel message forgery, and forged request responses without requiring IP address spoofing.
Risk Assessment
The risk includes session hijacking, disconnection of players, message forgery, and manipulation of gameplay, potentially leading to service disruption and data integrity compromise.
Recommendation
Upgrade Sonic 3 A.I.R. to a patched version (commit 2492d18 or later). Additionally, consider encrypting UDP traffic or implementing packet authentication mechanisms.
Other vulnerabilities in Sonic 3 A.I.R.
Original NVD description (English source)
Sonic 3 A.I.R. before commit 2492d18 contains a missing source address validation vulnerability in ConnectionManager where established connections are resolved by a two-byte local connection handle alone without verifying that the datagram source address matches the registered remote address for the connection. An on-path attacker who can observe cleartext UDP traffic can inject arbitrary packets into any established session by forging the two-byte connection identifier, enabling session termination via TerminateConnectionPacket, arbitrary channel message forgery, and forged request responses without requiring IP address spoofing.