Memory Corruption in nDPI DNS Dissector

Executive Summary

CVE-2026-88357 is a memory access vulnerability in nDPI 5.1.0 where specially crafted network input causes byte-buffer addresses at odd offsets to be cast to wider integer pointers and dereferenced without alignment checks. This leads to undefined behavior, process termination in UBSan builds, or crashes on strict-alignment architectures, resulting in denial of service.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring for crashes or undefined behavior in nDPI-based applications processing DNS traffic. Use network monitoring tools like Wireshark to inspect DNS packets for malformed payloads with odd offsets or unusual QDCOUNT values. Enable sanitizers like UBSan during compilation to catch alignment violations. Check application logs for SIGILL or UBSan errors indicating unaligned memory access.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause denial of service by crashing applications using nDPI when processing malformed DNS packets or other crafted input. It is particularly severe on strict-alignment architectures like ARM, MIPS, or RISC-V, where it may trigger native faults, while on x86-64 it causes crashes in UBSan-instrumented builds.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade nDPI to a patched version that includes alignment fixes and memcpy-based multi-byte reads.
• Recompile applications using nDPI with flags like -fno-sanitize-recover=all to prevent sanitizer-induced crashes.
• Deploy network-level protections to filter malformed DNS packets that trigger unaligned access.
• Audit custom code using nDPI for unsafe pointer casts and replace with alignment-safe methods.

Useful 0 Not Useful 0