Description

ION-DTN versions before 4.2.0 contain an out-of-bounds read vulnerability in the decodeSdnv function that allows unauthenticated remote attackers to read memory by sending truncated SDNV values. Attackers can send a UDP datagram to the LTP link service input port with a truncated SDNV to trigger reads up to nine bytes past buffer boundaries and underflow byte counters.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-02T02:17:20.450Z",
  "pubdate": "2026-09-02T02:17:20.450Z",
  "executiveSummary": "ION-DTN versions prior to 4.2.0 are susceptible to an out-of-bounds (OOB) read vulnerability located within the decodeSdnv function. This flaw arises from improper validation of Self-Delimiting Numeric Values (SDNVs) during the deserialization process. An unauthenticated, remote attacker can exploit this weakness by crafting and transmitting a malicious UDP datagram containing a truncated SDNV to the LTP (Liaison Transfer Protocol) link service input port.\nSuccessful exploitation allows an attacker to trigger an out-of-bounds read, accessing memory up to nine bytes beyond the allocated buffer boundaries. Furthermore, the vulnerability can cause an underflow of associated byte counters, potentially leading to instability or unintended memory disclosure. This vulnerability poses a significant risk to the integrity and confidentiality of the ION-DTN runtime environment. Given that the attack requires no authentication and can be executed remotely via standard network protocols, it represents a high-impact security concern for systems utilizing the ION-DTN stack in space-based or terrestrial delay-tolerant networking applications.",
  "technicalDetails": "The vulnerability resides in the decodeSdnv function, which is responsible for decoding Self-Delimiting Numeric Values (SDNVs) used throughout the ION-DTN protocol suite. In the context of Delay-Tolerant Networking (DTN), SDNVs are variable-length fields used for encoding integers. The decodeSdnv function fails to correctly handle truncated inputs where the final byte of an expected SDNV sequence is missing or improperly delimited.\nThe root cause is a lack of rigorous bounds checking before processing the input byte stream. When the function receives a truncated SDNV, it continues to increment pointers and decrement byte counters based on the assumed length of the value. Because the logic does not validate that sufficient bytes exist to complete the SDNV sequence, the function pointer traverses past the actual buffer limit.\nThe attack flow begins when an attacker sends a specially crafted UDP datagram to the port configured for the LTP link service. The payload includes a truncated SDNV field that forces the decodeSdnv function to read beyond the legitimate buffer boundary. This mechanism allows the attacker to reach up to nine bytes of memory located immediately adjacent to the target buffer. The underflow of internal byte counters further exacerbates the vulnerability, as it may cause subsequent parsing logic to miscalculate offsets, leading to further memory access errors or potential logic corruption.\nThis vulnerability is classified as an out-of-bounds read because it enables an attacker to leak sensitive memory contents that could contain cryptographic keys, session tokens, or other sensitive runtime data. While the current impact is primarily documented as a memory read, the underflow of byte counters could potentially be leveraged to affect system stability or facilitate more complex exploitation chains depending on how the calling functions manage the resulting state. The vulnerability is inherent to the parsing logic and does not require the attacker to possess prior authentication or elevated privileges, making it accessible to any actor capable of reaching the LTP link service over the network. Versions of ION-DTN prior to 4.2.0 are definitively affected due to the absence of the necessary bounds verification logic in the handling of SDNV decoding."
}