CVE-2026-84484 ION-DTN before 4.2.0 Out-of-Bounds Read via decodeSdnv
Unauthenticated remote attackers can read memory via truncated SDNV values in ION-DTN, potentially exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-84484?
CVE-2026-84484 is a high-severity vulnerability in nasa-jpl ION-DTN, published on 2 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ION-DTN versions before 4.2.0 contain an out-of-bounds read vulnerability in the decodeSdnv function that allows unauthenticated remote attackers to read memory by sending truncated SDNV values. Attackers can send a UDP datagram to the LTP link service input port with a truncated SDNV to trigger reads up to nine bytes past buffer boundaries and underflow byte counters.
Weakness: CWE-125
Which versions are affected by CVE-2026-84484?
How do I fix CVE-2026-84484?
No fix has been published for CVE-2026-84484 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-84484 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-84484 exists.
Sources
Also known as GHSA-5vmj-4h65-2fh8, GHSA-85pw-28vw-2jf7.