Heap-based Buffer Overflow in CESNET ipfixcol2

Executive Summary

CVE-2026-122127 is a heap-based buffer overflow in CESNET ipfixcol2 versions 2.7.1 through 2.8.9. It occurs in the Lz4Decoder.cpp file of the TCP input plugin. Attackers exploit a mismatch between declared ring buffer size and decompressed data size to write up to 65,535 controlled bytes past allocated heap memory, causing crashes or potential code execution.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes or unusual behavior in ipfixcol2 instances handling LZ4-compressed TCP traffic. Check logs for decompression errors or buffer overflow warnings. Use network traffic analysis tools like Wireshark to inspect TCP streams for malformed LZ4 headers or unexpected payload sizes.

Useful 0 Not Useful 0

Impact Analysis

Unauthenticated network attackers can crash the ipfixcol2 collector or execute arbitrary code by sending maliciously crafted LZ4-compressed IPFIX data over TCP. This disrupts flow data collection and may lead to denial-of-service conditions or unauthorized system access.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized data access or modification. A heap-based buffer overflow may allow attackers to crash the collector or execute arbitrary code, potentially exposing or altering sensitive flow data. GDPR requires protecting personal data integrity, while HIPAA mandates secure handling of health-related information. Exploitation could lead to data breaches or unauthorized disclosure, violating these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade ipfixcol2 to version 2.9.0 or later immediately. If upgrading is not possible, disable the TCP input plugin or block LZ4-compressed traffic at the network perimeter until patched. Monitor affected systems for signs of exploitation.

Useful 0 Not Useful 0