Quick answers
- Is CVE-2026-121510 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-121510 being exploited in the wild.
- How severe is CVE-2026-121510?
- High severity, with a CVSS score of 7.5, published 3 November 2026.
- Which products and versions are affected?
- D3TN µD3TN.
- Is there a fix for CVE-2026-121510?
- No fixed version is recorded yet. Restrict which peers and convergence layers can deliver bundles to the node, limiting exposure to trusted networks until a patch is applied. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-121510 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-121510?
- Check whether you run D3TN µD3TN. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Restrict which peers and convergence layers can deliver bundles to the node, limiting exposure to trusted networks until a patch is applied.
Technical details
The BPv6 administrative record parser in components/bundle6/reports.c contains an off-by-one error in the source EID field parsing: it decrements a uint16_t byte counter before testing for zero, causing integer underflow when a zero length is declared. This allows writing up to 65535 attacker-controlled bytes past a one-byte heap allocation. The vulnerability is reachable via any convergence layer (mtcp, smtcp, TCPCLv3) without authentication, as it processes incoming bundles addressed to the local node before any credential validation.
Affected products
- D3TN µD3TN
Timeline
- 2026-11-03: disclosed