Heap Overflow in µD3TN SPP Parser Causes DoS

Executive Summary

CVE-2026-121513 is an off-by-one heap overflow in the µD3TN v0.15.1 SPP Parser. It occurs when parsing the timecode P-field, where an attacker exploits a secondary header to trigger a heap overflow in the fractional_buf buffer. The issue stems from an incorrect buffer size and missing range checks, allowing the fractional_octets count to exceed its limit due to unchecked accumulation across multiple P-field octets.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes in the µD3TN daemon (ud3tn) after receiving malformed SPP frames. Check logs for heap corruption errors like 'double free or corruption' or 'heap-buffer-overflow'. Use AddressSanitizer builds to identify heap-buffer-overflow during parsing.

Useful 0 Not Useful 0

Impact Analysis

An unauthenticated remote attacker can exploit this flaw to corrupt the daemon's heap, causing a denial-of-service (DoS) condition. The attack reliably crashes the daemon by sending a malformed SPP frame, leading to heap corruption errors like double free or heap-buffer-overflow.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the tcpspp convergence layer if enabled. Update to a patched version of µD3TN once available. Implement network-level filtering to block malformed SPP frames. Monitor for unusual daemon crashes or heap corruption errors.

Useful 0 Not Useful 0