Is CVE-2026-123999 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-123999 being exploited in the wild.

How severe is CVE-2026-123999?

High severity, with a CVSS score of 7.5, published 9 November 2026.

Which products and versions are affected?

NASA JPL ION-DTN 3.6.2 through 4.2.0.

How is CVE-2026-123999 attacked?

It is attacked over the network or with local access, in a software library.

Am I affected by CVE-2026-123999?

Check whether you run NASA JPL ION-DTN at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123999: NASA JPL ION-DTN heap-based buffer overflow in nm_mgr

CVE-2026-123999 · Severity: high · CVSS 7.5 · Published 2026-11-09

NASA's ION-DTN is a delay-tolerant networking software suite used for deep-space communications and remote sensor networks. A heap-based buffer overflow in the Network Management daemon allows attackers to send specially crafted network messages that crash the daemon, disrupting telemetry collection and operator visibility of critical space and remote operations. This can be triggered remotely over the network if logging is enabled, or locally through the interactive UI.

Technologies: NASA JPL ION-DTN. Vendors: NASA JPL.

Quick answers

Is CVE-2026-123999 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-123999 being exploited in the wild.
How severe is CVE-2026-123999?: High severity, with a CVSS score of 7.5, published 9 November 2026.
Which products and versions are affected?: NASA JPL ION-DTN 3.6.2 through 4.2.0.
Is there a fix for CVE-2026-123999?: Yes: fixed in 4.2.1-a.2. Until then: Disable file logging and parsed-report logging (-l -r flags) if not strictly required, as these are disabled by default and prevent automatic remote triggering. Additionally, restrict AMP management traffic to trusted network peers and isolate it from untrusted network segments to provide defense-in-depth.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-11-07"}, {"kind": "advisory", "at": "2026-11-09"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123999 attacked?: It is attacked over the network or with local access, in a software library.
Am I affected by CVE-2026-123999?: Check whether you run NASA JPL ION-DTN at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.2.1-a.2

Disable file logging and parsed-report logging (-l -r flags) if not strictly required, as these are disabled by default and prevent automatic remote triggering. Additionally, restrict AMP management traffic to trusted network peers and isolate it from untrusted network segments to provide defense-in-depth.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-11-07"}, {"kind": "advisory", "at": "2026-11-09"}]

Technical details

A heap-based buffer overflow exists in nm_mgr's string-formatting logic due to unbounded strcat operations on fixed-size buffers (1–8 KiB) during recursive Asynchronous Message Protocol (AMP) payload processing. An attacker or misconfigured agent can send deeply nested AMP payloads that exceed buffer capacity, triggering out-of-bounds writes into adjacent heap memory. The vulnerability is reachable remotely via UDP CLA/AMP if logging is enabled (disabled by default), or locally via interactive UI rendering, resulting in daemon crash and denial of service.

Affected products

NASA JPL ION-DTN 3.6.2 through 4.2.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.