CVE-2026-124001: critical vulnerability in nasa-jpl ION-DTN
ION-DTN 2.2.1b-4.2.0 Integer Overflow Heap Corruption via DGR
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.2epss 0.5%
NASA JPL ION-DTN 2.2.1b through 4.2.0 contains an integer overflow vulnerability in the Datagram Retransmission (DGR) convergence layer that allows attackers to corrupt heap memory by sending a maliciously crafted 64-bit svcDataLength value that wraps a 32-bit allocation size calculation. Attackers can exploit the dgr_receive API's unchecked memcpy operation using synthetic datagrams or DGR traffic over internal IPC or custom transports to trigger an out-of-bounds write, leading to denial of service or potential remote code execution.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
nasa-jpl · ION-DTNRelated CVEs — nasa-jpl ION-DTN
In the same product, most dangerous first.
CVE-2026-84484HIGHION-DTN before 4.2.0 Out-of-Bounds Read via decodeSdnvEPSS 0.9%CVE-2026-75584HIGHION-DTN < 4.2.1-a.1 Denial of Service via canonicalizePayloadBlock() AssertionEPSS 0.6%CVE-2026-124000MEDIUMION-DTN 2.1.0-4.2.0 Heap Buffer Under-allocation DoS in amsdEPSS 0.5%CVE-2026-123999HIGHION-DTN 3.6.2-4.2.0 Heap Buffer Overflow via nm_mgr AMP RenderingEPSS 0.5%CVE-2024-54129CRITICALImproper Initialization of `imc` Scheme Leading to `SIGABRT` in ION-DTN BPv7EPSS 0.4%CVE-2024-54130CRITICALSegmentation Fault in `forwardBundle` Function of ION-DTN BPv7 When Destination EID is `dtn:none` (public)EPSS 0.4%