CVE-2026-66349

Received Received - Intake

MMS Server Buffer Overflow via BER-Encoded Request

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: ICS-CERT

Description

The MMS server connection handler contains a flaw in its processing of BER-encoded request data. When an MMS confirmed request PDU containing an extended BER tag is received over an established session, the decoder may advance its internal buffer incorrectly due to a missing bounds check. This results in a one byte heap out-of-bounds read and causes the MMS service process to terminate, leading to a denial-of-service condition.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-66349

EUVD

EUVD-2026-51340

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is a denial-of-service issue in an MMS server connection handler. It occurs when the server processes a specific type of request containing extended BER-encoded data. The flaw causes the decoder to incorrectly advance its internal buffer, leading to a one-byte heap out-of-bounds read. This crashes the MMS service process, disrupting service.

Detection Guidance

This vulnerability involves a heap out-of-bounds read in MMS server processing of BER-encoded requests. Detection requires monitoring for crashes in MMS service processes after receiving specific malformed PDUs. Check logs for service termination events and inspect network traffic for MMS confirmed request PDUs with extended BER tags.

Impact Analysis

If exploited, this vulnerability could cause the MMS service to crash, resulting in a denial-of-service. This means the service would become unavailable, potentially disrupting communication or operations dependent on the MMS server.

Compliance Impact

This vulnerability causes a denial-of-service condition by terminating the MMS service process, which could disrupt critical communication systems. For compliance with standards like GDPR or HIPAA, such disruptions may impact data availability and integrity requirements, potentially leading to non-compliance if systems fail to maintain expected uptime or secure data processing.

Mitigation Strategies

Update the MMS server software to the latest patched version to fix the BER-encoded request handling flaw. Monitor network traffic for unusual MMS confirmed request PDUs with extended BER tags. Restrict access to the MMS service to trusted networks only.

Hi! I’m here to help you understand CVE-2026-66349. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70