Is CVE-2026-121511 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-121511 being exploited in the wild.

How severe is CVE-2026-121511?

High severity, with a CVSS score of 7.1, published 3 November 2026.

Which products and versions are affected?

D3TN µD3TN 0.15.1 and earlier.

How is CVE-2026-121511 attacked?

It is attacked over the network.

Am I affected by CVE-2026-121511?

Check whether you run D3TN µD3TN at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-121511: µD3TN BPv6/BPv7 Fragmenter heap buffer out-of-bounds read

CVE-2026-121511 · Severity: high · CVSS 7.1 · Published 2026-11-03

µD3TN is a delay-tolerant networking daemon that routes data bundles when traditional networks are unavailable. A flaw in its fragmenter allows an attacker to read sensitive data from the daemon's memory and forward it to other nodes, or crash the daemon by triggering access to unmapped memory. The vulnerability requires the daemon to run with external dispatch enabled and no dispatcher authentication, making it exploitable by any local network actor.

Technologies: D3TN µD3TN. Vendors: D3TN.

Quick answers

Is CVE-2026-121511 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-121511 being exploited in the wild.
How severe is CVE-2026-121511?: High severity, with a CVSS score of 7.1, published 3 November 2026.
Which products and versions are affected?: D3TN µD3TN 0.15.1 and earlier.
Is there a fix for CVE-2026-121511?: No fixed version is recorded yet. Disable external dispatch mode (`--external-dispatch`) unless required, and always configure a dispatcher secret (via the daemon's configuration mechanism) to authenticate dispatcher connections when external dispatch is in use. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-121511 attacked?: It is attacked over the network.
Am I affected by CVE-2026-121511?: Check whether you run D3TN µD3TN at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Disable external dispatch mode (`--external-dispatch`) unless required, and always configure a dispatcher secret (via the daemon's configuration mechanism) to authenticate dispatcher connections when external dispatch is in use.

Technical details

The BPv6 and BPv7 fragmenters use a bounds check (`fragment_offset + fragment_length > payload_length`) with `uint64_t` operands that wraps when the offset is near 2^64, allowing an out-of-bounds memcpy read before the payload buffer. An unauthenticated AAP 2.0 dispatcher client can supply an arbitrary `fragment_offset` that bypasses this check, causing the copy to read heap memory at a backward distance of `2^64 - fragment_offset`, disclosing heap content or causing a crash if the address is unmapped. Exploitation requires the daemon to be started with the `--external-dispatch` flag and no dispatcher secret.

Affected products

D3TN µD3TN 0.15.1 and earlier

Timeline

2026-11-03: disclosed

References

https://gitlab.com/d3tn/ud3tn/-/work_items/290

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.