CVE-2026-39929
Out-of-Bounds Read in SysTrack Agent
Publication date: 2026-05-28
Last updated on: 2026-05-28
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| lakeside_software | systack_agent | to 11.2.1.28 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
| CWE-754 | The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Lakeside SysTrack Agent versions prior to 11.2.1.28, 11.3.0.38, 11.4.0.24, and 11.5.0.15. It is an out-of-bounds read issue in the Command ID 30 UDP packet handler. Remote attackers can exploit this by sending a specially crafted UDP packet containing a malformed payload with an invalid memory address at offset 0x4. This triggers an access violation that causes the application to crash.
How can this vulnerability impact me? :
The primary impact of this vulnerability is a denial of service (DoS) condition. An attacker can remotely crash the Lakeside SysTrack Agent application by sending a malicious UDP packet, causing the application to stop functioning. This can disrupt monitoring or management services that rely on the agent.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability described is an out-of-bounds read in the Lakeside SysTrack Agent that allows remote attackers to cause a denial of service by crashing the application. There is no information provided about any impact on data confidentiality, integrity, or privacy that would directly relate to compliance with standards such as GDPR or HIPAA.
Since the vulnerability results in a denial of service without indication of data exposure or unauthorized data access, its effect on compliance with regulations like GDPR or HIPAA cannot be determined from the provided information.