CVE-2026-66733 Details
Description
Sonic 3 A.I.R. before commit 2492d18 contains an unbounded memory allocation vulnerability in ReceivedPacketCache::enqueuePacket() that allows unauthenticated remote attackers to crash the server process by sending a crafted UDP packet with mUniquePacketID set to the maximum uint32 value. The mUniquePacketID field is read directly from the UDP wire-format packet header without bounds checking, causing the server to allocate one CacheItem per missing packet ID gap, exhausting available host memory and propagating an uncaught std::bad_alloc exception to std::terminate().
A denial-of-service vulnerability has been identified in Sonic 3 A.I.R. versions through 26.03.28.0. The issue arises from an unbounded memory allocation in the ReceivedPacketCache::enqueuePacket() function. This vulnerability allows unauthenticated remote attackers to crash the server process by sending a crafted UDP packet with the mUniquePacketID field set to the maximum uint32 value. The server reads this field directly from the UDP packet header without proper bounds checking, leading to excessive memory allocation. Each missing packet ID gap causes the server to allocate one CacheItem, which can exhaust available host memory. This memory exhaustion triggers an uncaught std::bad_alloc exception, causing the server to terminate.
Users can update to Sonic 3 A.I.R. version 26.03.28.1 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 6, 2026CISA-ADP
Assessed Aug 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-789 | Memory Allocation with Excessive Size Value | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Eukaryot Sonic 3 A.I.R. | <= 26.03.28.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 6, 2026 | CVE Modified | CISA-ADP |
| Aug 6, 2026 | New CVE Received | [email protected] |