CVE-2026-124001: ION-DTN 2.2.1b-4.2.0 Integer Overflow Heap Corruption via DGR
NASA JPL ION-DTN 2.2.1b through 4.2.0 contains an integer overflow vulnerability in the Datagram Retransmission (DGR) convergence layer that allows attackers to corrupt heap memory by sending a maliciously crafted 64-bit svcDataLength value that wraps a 32-bit allocation size calculation. Attackers can exploit the dgrreceive API's unchecked memcpy operation using synthetic datagrams or DGR traffic over internal IPC or custom transports to trigger an out-of-bounds write, leading to denial of service or potential remote code execution.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
ION-DTN versions 2.2.1b through 4.2.0 are affected where the Datagram Retransmission (DGR) convergence layer can receive DGR traffic. Exposure includes synthetic datagrams and DGR traffic delivered through internal IPC or custom transports.
What must an attacker provide to trigger the vulnerability?
The attacker must send a maliciously crafted 64-bit svcDataLength value that causes a 32-bit allocation-size calculation to wrap. The resulting undersized allocation is followed by an unchecked memcpy in the dgr_receive API, producing an out-of-bounds heap write.
What is the likely impact of successful exploitation?
Successful exploitation can corrupt heap memory and cause denial of service. The advisory also identifies potential remote code execution.
Is a fixed release identified?
The affected range ends at version 4.2.0. The provided references include the ION-DTN 4.2.1-a.2 release.