CVE-2026-102712: High severity vulnerability
On the first DTLS ClientHello, the parser copies a device-claimed sessionid length and validates the
ciphersuite-list length against the total record length instead of the remaining bytes. An unauthenticated
peer drives an OOB source read of up to 255 bytes, and those bytes are echoed verbatim into the outgoing
ServerHello, disclosing adjacent process memory over the network. The crash variant fires on the first
packet.
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An unauthenticated peer only needs to send a crafted first DTLS ClientHello. The issue is reachable on the first packet, before authentication.
What information can be exposed?
The parser can read up to 255 bytes beyond the intended input buffer. Those adjacent process-memory bytes are echoed verbatim in the ServerHello and disclosed over the network.
Can exploitation also cause a denial of service?
Yes. A crash variant can be triggered by the first packet, so a crafted initial DTLS ClientHello may cause a denial of service in addition to memory disclosure.