CVE-2026-33846 Details

A heap buffer overflow vulnerability has been identified in GnuTLS within the DTLS handshake fragment reassembly process. The issue occurs in the 'merge_handshake_packet()' function, where incoming handshake fragments are combined based solely on handshake type. This approach fails to ensure that the 'message_length' field remains consistent across all fragments of the same logical message. An attacker can exploit this vulnerability by sending crafted DTLS fragments with conflicting 'message_length' values. This manipulation causes the implementation to allocate a buffer based on a smaller initial fragment, which is then overwritten using larger, inconsistent fragments. The lack of proper bounds checking during the merging process leads to an out-of-bounds write on the heap. This vulnerability is remotely exploitable without authentication, via the DTLS handshake, and can result in application crashes or potential memory corruption.