CVE-2026-76989
Received Received - Intake

Out-of-Bounds Read in CIPster TCP Encapsulation Receive Path

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: VulDB

Description
A security vulnerability has been detected in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. This impacts an unknown function of the file source/src/enet_encap/encap.cc of the component TCP Encapsulation Receive Path. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is e8e9dba09bf56962807d3504b783ccdb6287f3e4. To fix this issue, it is recommended to deploy a patch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-76989
EUVD
EUVD-2026-63347

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
liftoff-sr cipster *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds read flaw in the liftoff-sr CIPster TCP Encapsulation Receive Path. It occurs when a TCP packet's declared payload length exceeds the receive buffer capacity. The function incorrectly reports a fake fully received length, causing the caller to parse stale data from previous requests as current data. This leads to a buffer overflow when the parser reads beyond allocated memory.

Detection Guidance

Detecting this vulnerability requires checking for the vulnerable version of liftoff-sr CIPster. Inspect the commit hash of your CIPster installation by running: git log --oneline | grep e8e9dba09bf56962807d3504b783ccdb6287f3e4. If this commit is not present, the system is likely vulnerable.

Impact Analysis

The vulnerability allows remote unauthenticated attackers to crash the server by sending specially crafted packets to TCP port 44818. After establishing a normal RegisterSession, an attacker can trigger a deterministic server-side crash through a sequence of requests. This results in a denial of service condition affecting availability of the service.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling remote denial-of-service attacks through out-of-bounds reads. GDPR requires data integrity and availability, while HIPAA mandates secure handling of protected health information. A denial-of-service could disrupt services handling sensitive data, violating availability requirements.

Mitigation Strategies

Immediately update to the patched version by applying the commit e8e9dba09bf56962807d3504b783ccdb6287f3e4. Alternatively, restrict network access to TCP port 44818 to limit exposure until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76989. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart