CVE-2026-84484 nasa-jpl CVE debrief

Who should care

Defenders responsible for ION-DTN installations should assess exposure and prioritize updating to version 4.2.0 or later. This includes operators, platform administrators, vulnerability management teams, and security teams who need to ensure that ION-DTN deployments are updated to mitigate the out-of-bounds read vulnerability. Unaffected deployments should verify their configurations and prepare for potential future updates.

Why it matters

ION-DTN versions before 4.2.0 contain an out-of-bounds read vulnerability that allows unauthenticated remote attackers to read memory by sending truncated SDNV values. Defenders responsible for ION-DTN installations should assess exposure and prioritize updating to version 4.2.0 or later.

• Unauthenticated remote attackers can read memory
• ION-DTN versions before 4.2.0 are vulnerable
• Truncated SDNV values can trigger out-of-bounds reads

Technical summary

ION-DTN versions before 4.2.0 contain an out-of-bounds read vulnerability in the decodeSdnv function that allows unauthenticated remote attackers to read memory by sending truncated SDNV values. The vulnerability can be exploited by sending a UDP datagram to the LTP link service input port with a truncated SDNV, potentially allowing attackers to read up to nine bytes past buffer boundaries and underflow byte counters. This issue is highly severe, with a CVSS score of 8.7, and defenders should prioritize updating to version 4.2.0 or later.

Defensive priority

High priority for updating ION-DTN to version 4.2.0 or later

Recommended defensive actions

• Update ION-DTN to version 4.2.0 or later
• Verify ION-DTN version and update if necessary
• Monitor ION-DTN for truncated SDNV values
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the out-of-bounds read vulnerability in ION-DTN versions before 4.2.0. The vulnerability allows unauthenticated remote attackers to read memory by sending truncated SDNV values.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.