CVE-2026-66733 Eukaryot CVE debrief

Who should care

Users of Sonic 3 A.I.R. before commit 2492d18 should be aware of this vulnerability and take steps to mitigate it. Affected operators should review official advisories and assess their exposure. Vulnerability management and security teams should prioritize patching and monitor for suspicious UDP traffic. Platform administrators should restrict UDP access to the server and implement bounds checking for packet IDs where possible.

Technical summary

The ReceivedPacketCache::enqueuePacket() function in Sonic 3 A.I.R. before commit 2492d18 contains an unbounded memory allocation vulnerability. This allows unauthenticated remote attackers to crash the server process by sending a crafted UDP packet with mUniquePacketID set to the maximum uint32 value. The mUniquePacketID field is read directly from the UDP wire-format packet header without bounds checking, causing the server to allocate one CacheItem per missing packet ID gap, exhausting available host memory.

Defensive priority

Unauthenticated remote attackers can crash the server process by sending a crafted UDP packet, indicating a high priority for patching.

Recommended defensive actions

• Apply the patch from commit 2492d18
• Restrict UDP access to the server
• Monitor for suspicious UDP traffic
• Implement bounds checking for packet IDs
• Review official advisories for affected scope and severity
• Confirm whether affected product deployments exist in managed environments
• Track exceptions and retest remediated assets

Evidence notes

The vulnerability exists in Sonic 3 A.I.R. before commit 2492d18 in the ReceivedPacketCache::enqueuePacket() function, which allows for unbounded memory allocation. The mUniquePacketID field is read directly from the UDP wire-format packet header without bounds checking. This issue can cause the server to allocate one CacheItem per missing packet ID gap, exhausting available host memory and propagating an uncaught std::bad_alloc exception to std::terminate(). Evidence is limited to public CVE and NVD details. Defenders should verify affected product deployments, review official advisories, and monitor for suspicious UDP traffic.

Official resources