CVE-2026-66733
Sonic 3 A.I.R. Unbounded Memory Allocation DoS via ReceivedPacketCache
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
Sonic 3 A.I.R. before commit 2492d18 contains an unbounded memory allocation vulnerability in ReceivedPacketCache::enqueuePacket() that allows unauthenticated remote attackers to crash the server process by sending a crafted UDP packet with mUniquePacketID set to the maximum uint32 value. The mUniquePacketID field is read directly from the UDP wire-format packet header without bounds checking, causing the server to allocate one CacheItem per missing packet ID gap, exhausting available host memory and propagating an uncaught std::bad_alloc exception to std::terminate().
| CWE | CWE-789 |
| Vendor | eukaryot |
| Product | sonic3air |
| Published | Aug 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for eukaryot sonic3air
Be the first to know when new high vulnerabilities affecting eukaryot sonic3air are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
Eukaryot / sonic3air
0 ≤ 26.03.28.0
References
Credits
Valentin Lobstein (Chocapikk)