Description

Gammu DCT3 trace file parser crash in 4.6.0 to 4.6.7 allows denial of service

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-08-13T09:17:12.857Z",
  "pubdate": "2026-08-13T09:17:12.857Z",
  "executiveSummary": "A denial of service vulnerability exists in the Gammu DCT3 trace file parser affecting versions 4.6.0 through 4.6.7. The vulnerability allows an unauthenticated attacker to cause a crash within the application by supplying a maliciously crafted input file. The primary impact of this flaw is application termination, leading to a denial of service for dependent workflows and monitoring capabilities. The risk implication is centered on service availability, particularly in automated environments processing untrusted trace data. Attacker capabilities are restricted to triggering the parsing failure, and exploitation typically requires an entity to process a specially crafted DCT3 trace file provided by the attacker.",
  "technicalDetails": "The vulnerability resides within the trace file parser component of Gammu, specifically in the logic handling DCT3 trace formats across versions 4.6.0 to 4.6.7. The root cause stems from improper input validation and memory handling when parsing malformed or unexpected structures within the trace data. When the vulnerable function encounters a crafted input file containing anomalous field values or corrupted byte sequences, it fails to handle the structural discrepancies safely. This deficiency triggers an invalid memory access, a null pointer dereference, or an out-of-bounds read condition, resulting in an immediate segmentation fault or unhandled exception. The attack flow commences when an adversary generates or modifies a DCT3 trace file to include specific payload anomalies designed to trigger the parsing error. The victim or an automated system then attempts to parse the trace file using the vulnerable Gammu parser. As the parsing routines process the malicious file structures, the software encounters the anomalous data, fails validation checks, and crashes. Network exposure and authentication requirements depend on the implementation context; if the parser is exposed via a network service or automated daemon processing external submissions, remote exploitation without authentication is possible. If the parser is executed locally, the attacker must deliver the file via local vector or trick a user into processing it. The post-exploitation impact is strictly limited to denial of service through application termination, as arbitrary code execution is not indicated by the vector description."
}