Out-of-Bounds Read in Eclipse tinydtls

Executive Summary

CVE-2026-9267 is an out-of-bounds read vulnerability in Eclipse tinydtls, specifically in the check_server_certificate() function.

The flaw occurs because the function lacks proper buffer length validation before performing certain operations like uint24 reads, memcmp, and memcpy during DTLS epoch 0.

An unauthenticated attacker can exploit this by crafting a Certificate handshake message with a specially chosen fragment_length value, causing the program to read beyond the valid buffer boundaries.

Useful 0 Not Useful 0

Impact Analysis

Exploiting this vulnerability can cause a denial of service (DoS) condition, especially on memory-constrained devices.

Since the vulnerability allows out-of-bounds reads, it can lead to crashes or unstable behavior in applications using Eclipse tinydtls.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update Eclipse tinydtls to a version that includes the fix from commit b3efd41ad111a4920f599f51ffa4f5e9f1e72221, which addresses the out-of-bounds read issue in the check_server_certificate() function.

Avoid processing untrusted Certificate handshake messages with crafted fragment_length values until the patch is applied.

Useful 0 Not Useful 0