Is CVE-2026-84484 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84484 being exploited in the wild.

How severe is CVE-2026-84484?

High severity, with a CVSS score of 7.5, published 2 September 2026.

Is there a fix for CVE-2026-84484?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-84484 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-84484?

Check whether you run Nasa ION-DTN at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84484: NASA ION-DTN out-of-bounds read in decodeSdnv

CVE-2026-84484 · Severity: high · CVSS 7.5 · Published 2026-09-02

ION-DTN is NASA's open-source implementation of Delay Tolerant Networking used for communication in challenging environments like deep space and remote locations. Versions before 4.2.0 contain an out-of-bounds memory read vulnerability that allows an unauthenticated attacker to read sensitive memory by sending specially crafted network packets to the LTP link service port, potentially exposing confidential data or configuration information.

Vendors: Nasa.

Quick answers

Is CVE-2026-84484 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84484 being exploited in the wild.
How severe is CVE-2026-84484?: High severity, with a CVSS score of 7.5, published 2 September 2026.
Which products and versions are affected?: Nasa ION-DTN before 4.2.0.
Is there a fix for CVE-2026-84484?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-84484 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-84484?: Check whether you run Nasa ION-DTN at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an out-of-bounds read in the decodeSdnv function, which parses SDNV (Self-Delimiting Numeric Value) structures used by ION-DTN's Link Transmission Protocol (LTP). An attacker can send a UDP datagram with a truncated SDNV value to trigger reads up to nine bytes past the allocated buffer boundary and cause byte counter underflows. The vulnerability is network-accessible without authentication; a remote attacker can exploit this by targeting the LTP link service input port. While the primary impact is information disclosure through memory read, the out-of-bounds access could potentially lead to crash conditions. Patches are available in version 4.2.0 and later.

Affected products

NASA ION-DTN before 4.2.0

Timeline

2026-09-02: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.