CVE-2026-66733
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
Sonic 3 A.I.R. before commit 2492d18 contains an unbounded memory allocation vulnerability in ReceivedPacketCache::enqueuePacket() that allows unauthenticated remote attackers to crash the server process by sending a crafted UDP packet with mUniquePacketID set to the maximum uint32 value. The mUniquePacketID field is read directly from the UDP wire-format packet header without bounds checking, causing the server to allocate one CacheItem per missing packet ID gap, exhausting available host memory and propagating an uncaught std::bad_alloc exception to std::terminate().
Risk Assessment
The attack can lead to complete exhaustion of server memory and crash, resulting in service unavailability. The vulnerability can be exploited remotely without authentication, increasing the risk of DoS attacks.
Recommendation
It is recommended to immediately upgrade to a version containing commit 2492d18 or later, which fixes this vulnerability. Additionally, restrict UDP server access to trusted sources only.
Other vulnerabilities in Sonic 3 A.I.R.
Original NVD description (English source)
Sonic 3 A.I.R. before commit 2492d18 contains an unbounded memory allocation vulnerability in ReceivedPacketCache::enqueuePacket() that allows unauthenticated remote attackers to crash the server process by sending a crafted UDP packet with mUniquePacketID set to the maximum uint32 value. The mUniquePacketID field is read directly from the UDP wire-format packet header without bounds checking, causing the server to allocate one CacheItem per missing packet ID gap, exhausting available host memory and propagating an uncaught std::bad_alloc exception to std::terminate().