CVE-2026-124000 Details

A heap buffer under-allocation vulnerability has been identified in NASA JPL ION-DTN versions 2.1.0 through 4.2.0. This vulnerability resides in the Asynchronous Message Service daemon (amsd) and allows a rogue or misconfigured peer to trigger an out-of-bounds write by sending crafted Meta-AMS (MAMS) configuration management messages. These messages are processed without cryptographic authentication, enabling attackers to exploit the insufficient buffer size calculation for internal state-event objects. This exploitation can crash the active Configuration Server thread, causing a denial-of-service condition and potentially destabilizing subsequent shared-memory allocations within amsd.

Users are advised to upgrade to ION-DTN version 4.2.1-a.2, which addresses the vulnerability by correcting the memory allocation bounds in the AMS event handlers and adding protections against integer overflow. For those using MAMS, it is recommended to restrict traffic to trusted internal peers and ensure that AMS continua are isolated behind local firewalls.