Loading story…
A remotely triggerable out-of-bounds read vulnerability was disclosed in traceroute 2.1.2, affecting MPLS extension parsing when the tool is run with -e. Researcher Mohamed Aziz Rahmouni reported that in traceroute/traceroute.c, the packet buffer pointer is advanced past the IP header after recvmsg(), but the packet length variable is not reduced before handle_extensions() is called. That mismatch can cause the parser to read past the actual received packet boundary and into uninitialized stack memory in buf[1280] when processing a crafted ICMP Time Exceeded response carrying MPLS extensions from an on-path network device.
The researcher said the flaw was identified through manual code review and dynamic fuzzing, confirmed with a working proof of concept, and could be corrected with a one-line fix that subtracts the header length from the packet length after advancing the buffer pointer. traceroute maintainer Dmitry Butskoy acknowledged the report on the oss-sec mailing list and said he would review it within hours, while the disclosure followed a 90-day responsible disclosure timeline with public technical details planned unless a patch is released sooner.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
In follow-up oss-sec discussion, Dmitry Butskoy said the cited code had long included the key "n -= hlen;" logic, including in current traceroute releases, and Solar Designer questioned why the report targeted 2.1.2. The thread indicated the reported MPLS parsing out-of-bounds read was likely based on faulty analysis rather than a confirmed vulnerability.
Dmitry Butskoy replied on oss-sec acknowledging the vulnerability report and said he would review it within a few hours. The follow-up reiterated the planned 90-day disclosure timeline, with public disclosure targeted for 2026-07-27 unless a patch is released sooner.
On the oss-sec mailing list, Mohamed Aziz Rahmouni disclosed an out-of-bounds read vulnerability in traceroute 2.1.2 affecting MPLS extension parsing. The report said the flaw is remotely triggerable by an on-path device via a crafted ICMP Time Exceeded response to traceroute -e, included a confirmed proof of concept, and proposed a one-line fix.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
OpenBSD disclosed **CVE-2026-56099**, a medium-severity flaw in the MPLS subsystem that can expose kernel stack memory to a remote attacker when MPLS is enabled on an interface. The bug is in `mpls_do_error()` in `sys/netmpls/mpls_input.c`, where a crafted MPLS packet with **16 labels** and no **Bottom-of-Stack** bit causes the kernel to copy **17 shim headers** from a **16-entry** local stack array, leaking **4 bytes** of adjacent kernel stack data in an ICMP/MPLS error response. The issue affects OpenBSD `-current` before the fix and traces back to code introduced in 2010 in the ICMP/MPLS error-handling path. Exploitation requires an attacker to send an MPLS frame with EtherType `0x8847`, an outer label TTL of `1`, and an IPv4 inner payload; researchers at **Argus Systems** reported the vulnerability, and OpenBSD corrected it by rejecting label stacks that reach the maximum depth without a BoS bit.
Jun 29, 2026
A critical vulnerability tracked as **`CVE-2026-56786`** affects **RTKLIB through version 2.4.3**. The flaw is an out-of-bounds write in the `decode_type1033` function, where length counters are not properly clamped to destination buffer sizes. A crafted RTCM3 type-1033 message with a valid CRC can trigger an overflow of up to **191 bytes** into fixed **64-byte** descriptor fields, corrupting adjacent members of the `rtcm_t` object. The issue is considered remotely exploitable when an attacker can control an **NTRIP** or serial **RTCM3 correction stream**, potentially leading to **arbitrary code execution** or **denial of service**. The vulnerability has been rated **9.8** under **CVSS 3.1** and **9.3** under **CVSS 4.0**. Recommended mitigations include updating RTKLIB, applying the vendor patch for `decode_type1033`, validating buffer lengths before writes, and sanitizing input length counters.
Jun 29, 2026
Erlang/OTP disclosed **CVE-2026-49759**, a high-severity stack buffer overflow in the `inet_drv` SCTP error-cause parsing path that can let an unauthenticated remote attacker crash the BEAM VM. The flaw is in `sctp_parse_error_chunk` in `erts/emulator/drivers/common/inet_drv.c`, where crafted SCTP `ERROR` chunks can overflow a fixed-size stack buffer while cause codes are converted into `ErlDrvTermData` entries. Exploitation requires SCTP support to be enabled, a listening SCTP socket to be exposed through `gen_sctp` using the default `inet` backend, and network reachability to that port; Windows builds are not affected because SCTP is unsupported there. Advisories and the upstream patch indicate the issue is primarily **denial of service**, not expected remote code execution, because stack protections should terminate the process before meaningful control of execution is possible and the overwrite pattern is constrained. A crafted packet may also leak limited Erlang VM memory in an error response. The vulnerability affects OTP releases from **17.0** up to but excluding **27.3.4.13**, **28.5.0.2**, and **29.0.2**. The fix adds bounds checking and truncation safeguards in SCTP parsing and related async-event handling to prevent output term buffer overruns during malformed packet processing.
Jun 29, 2026