Description

Unnumbered Disconnect (U DISC) and malformed Aviation Very High Frequency Link Control frames can terminate sessions and lead to a loss of CPDLC functions requiring a reversion to voice communication and increased controller workload. This type of attack can be carried out remotely over radio frequency.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-07T19:17:33.893Z",
  "pubdate": "2026-08-07T19:17:33.893Z",
  "executiveSummary": "A session termination and denial of service vulnerability exists within aviation data link communications affecting Aviation Very High Frequency Link Control frames and Controller-Pilot Data Link Communications (CPDLC) functions. The vulnerability allows remote attackers transmitting via radio frequency to inject unnumbered disconnect (U DISC) and malformed frames into the communications channel. Successful exploitation terminates active data link sessions, resulting in a complete loss of CPDLC capabilities and forcing pilots and air traffic controllers to revert to traditional voice communication. This degradation increases controller workload, disrupts operational efficiency, and presents significant safety implications for aviation operations. The attack vector requires remote capabilities leveraging radio frequency transmission, though no authentication or prior system access is explicitly mentioned as a prerequisite for frame injection. Risk implications are severe due to the critical nature of air traffic management communications and the potential for widespread disruption in affected airspace sectors.",
  "technicalDetails": "The vulnerability stems from inadequate input validation, state management, and frame authentication within the processing logic of Aviation Very High Frequency Link Control protocols and associated Controller-Pilot Data Link Communications (CPDLC) components. The affected component is the data link control layer responsible for managing session states and parsing incoming radio frequency transmissions. Specifically, the system fails to adequately validate the authenticity, integrity, and sequence state of incoming control frames.\nThe attack flow proceeds as follows. An unauthorized remote attacker equipped with radio frequency transmission hardware targets the communication frequency utilized by the target aircraft and ground stations. The attacker crafts and broadcasts malicious radio frequency signals containing Unnumbered Disconnect (U DISC) frames or otherwise malformed Aviation Very High Frequency Link Control frames. Upon reception by the vulnerable avionics or ground system receiver, the processing component improperly accepts these frames without verifying session context or control legitimacy.\nThe root cause payload behavior triggers an abrupt termination of the active data link session upon processing the malicious U DISC or malformed frame. Because the state machine transitions immediately to a disconnected state upon receipt of the invalid control directive, active CPDLC functions are forcefully severed. Post-exploitation impact manifests as a complete loss of digital data link communication channels, requiring air traffic control and flight crews to transition operations entirely to backup voice communication methods. This sudden loss of automation and data exchange results in an immediate increase in controller workload and cognitive burden, potentially impacting communication throughput in busy airspace sectors. The exploitation method requires network exposure via radio frequency waves, operates remotely without requiring authentication or privileges, and exploits inherent trust in the link control protocol implementation."
}