Sonic 3 A.I.R. before commit 2492d18 contains an unbounded memory allocation vulnerability in ReceivedPacketCache::enqueuePacket() due to reading mUniquePacketID from UDP wire-format packet header without bounds checking. Unaffected deployments should review official advisories and assess exposure. Vulnerability management teams should prioritize patching and monitor for suspicious UDP traffic. Platform a [truncated]
Sonic 3 A.I.R. before commit 2492d18 contains a missing source address validation vulnerability in ConnectionManager. The CVE record was published on 2026-08-06T13:18:21.773Z and has not been modified since then. This vulnerability allows an on-path attacker to inject arbitrary packets into established sessions by forging the two-byte connection identifier, enabling session termination, arbitrary channel [truncated]
