CVE-2026-66733

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-66733
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-66733.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-66733
Published
2026-08-06T12:58:05.286Z
Modified
2026-08-08T09:11:58.708005Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Sonic 3 A.I.R. Unbounded Memory Allocation DoS via ReceivedPacketCache
Details

Sonic 3 A.I.R. before commit 2492d18 contains an unbounded memory allocation vulnerability in ReceivedPacketCache::enqueuePacket() that allows unauthenticated remote attackers to crash the server process by sending a crafted UDP packet with mUniquePacketID set to the maximum uint32 value. The mUniquePacketID field is read directly from the UDP wire-format packet header without bounds checking, causing the server to allocate one CacheItem per missing packet ID gap, exhausting available host memory and propagating an uncaught std::bad_alloc exception to std::terminate().

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-789"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66733.json"
}
References

Affected packages

Git / github.com/eukaryot/sonic3air

Affected ranges

Type
GIT
Repo
https://github.com/eukaryot/sonic3air
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
2492d1882cd2cf1cc1d7415729ce5c4fd686cd4f
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "26.03.28.0"
        }
    ]
}

Affected versions

v22.*
v22.01.09.0-test
v22.01.23.0-test
v22.02.13.0-test
v22.04.23.0-test
v22.05.08.0-test
v22.07.03.0-test
v22.07.31.0-test
v22.07.31.1-test
v22.07.31.2-test
v22.08.07.0-test
v22.08.07.1-test
v22.08.13.0-test
v22.08.21.0-test
v22.09.10.0-stable
v22.12.15.0-test
v23.*
v23.01.15.0-test
v23.03.25.0-test
v23.05.15.0-test
v23.08.27.0-test
v23.10.07.0-test
v23.11.10.0-test
v23.11.12.0-test
v23.11.12.1-test
v23.11.18.0-preview
v24.*
v24.01.07.0-test
v24.02.02.0-stable
v24.06.18.0-test
v24.06.21.0-test
v24.07.04.0-test
v24.07.10.0-test
v24.12.05.0-test
v25.*
v25.01.12.0-test
v25.02.15.0-test
v25.12.31.0-test
v26.*
v26.01.31.0-test
v26.02.15.0-test
v26.02.28.0-preview
v26.03.28.0-stable
v26.07.12.0-test
v26.07.12.1-test

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-66733.json"
vanir_signatures 
[
    {
        "source": "https://github.com/eukaryot/sonic3air/commit/2492d1882cd2cf1cc1d7415729ce5c4fd686cd4f",
        "id": "CVE-2026-66733-1969cc06",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "5624269680463886541978609279046594914",
                "113450266477642467652392381767348629255",
                "265849690712191467488726053524699705356",
                "199503416601196331675274615284417748377",
                "24784534590711869764212393912763385756",
                "97843941489644147753669932705155221666",
                "174540928961572168315894195503679722389",
                "307006705126550402605959469252017724328",
                "154152364725688658533241597911988867344",
                "119865447882420075017914182348125323222",
                "192379465815436829383656936558971060737",
                "176817287069271452291342913829984989980",
                "231171884091473056702722056888789858179",
                "6945945582830893975894810877027749634",
                "238340518585325406655036294365488942755",
                "85582494031904366808406485418653847482",
                "163828376546612963030571360055303866177",
                "295741022074362885055039303208974027155",
                "64582105038791240902091810384458987881",
                "291514188009471059391024439867472939745",
                "63755804739504920850204013462762052899",
                "241973660486813502268554719092557388333",
                "198593738289238799625256313502009181105",
                "207136618007815250439169271721192944069",
                "109094317342919296048247602639432377130",
                "237543941712230074845647762987496038779",
                "48140445616269931838788412720451209900",
                "157872978560267765362912420770110001929",
                "52011510920533487466137751541255849736",
                "95692779903927848971268983716855502695",
                "58701232737614812382421533945417428093",
                "286918447046360830493292785104504471387",
                "40856273045921600128068534627337159797",
                "22222448686072509863923440452983485212",
                "73713763492245466607352799007430157615"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "deprecated": false,
        "target": {
            "file": "Oxygen/oxygenengine/source/oxygen_netcore/network/Sockets.h"
        }
    },
    {
        "source": "https://github.com/eukaryot/sonic3air/commit/2492d1882cd2cf1cc1d7415729ce5c4fd686cd4f",
        "id": "CVE-2026-66733-2883fa31",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "106148897609971401461335324462421687163",
                "29101072999000660969070660476539499783",
                "172682873690776996683776613443171523071",
                "71847648258394871467504416681431825398",
                "246204507088019104491813715177118131089",
                "60989298919135612879046068298280039310",
                "82822685724548525988730417116442587817",
                "65217390983847098952155933968214115905",
                "101821120613116055118867431352797414050",
                "136810297561117529852730839070157214524",
                "121985383051649742833258574397465921425",
                "123372937239023054320918328678565826989",
                "156731648916598397232480607899858555038",
                "232471586807000710114046075674421501941",
                "160675400118146787162808151710075401988",
                "49457923558925955669802178036133163502",
                "239413101416173747421090575412397198343",
                "21273665248998299177551512231210381518",
                "157460208416030603296069898713269913753",
                "196039366430857431229938103739888556438",
                "52269975576401845203244021771583348629",
                "252228815023104129019808073954336948657"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "deprecated": false,
        "target": {
            "file": "Oxygen/oxygenengine/source/oxygen_netcore/network/Sockets.cpp"
        }
    },
    {
        "source": "https://github.com/eukaryot/sonic3air/commit/2492d1882cd2cf1cc1d7415729ce5c4fd686cd4f",
        "id": "CVE-2026-66733-2c0c2b8c",
        "signature_version": "v1",
        "digest": {
            "function_hash": "205709479392261448933544942036354580278",
            "length": 2663.0
        },
        "signature_type": "Function",
        "deprecated": false,
        "target": {
            "file": "Oxygen/oxygenengine/source/oxygen_netcore/network/NetConnection.cpp",
            "function": "NetConnection::handleLowLevelPacket"
        }
    },
    {
        "source": "https://github.com/eukaryot/sonic3air/commit/2492d1882cd2cf1cc1d7415729ce5c4fd686cd4f",
        "id": "CVE-2026-66733-47e7b6f0",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "106835449887000219390244930032682842911",
                "207343679462306720240145401057237030096",
                "176959296752975491830868836135546854678"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "deprecated": false,
        "target": {
            "file": "Oxygen/oxygenengine/source/oxygen_netcore/network/internal/ReceivedPacketCache.cpp"
        }
    },
    {
        "source": "https://github.com/eukaryot/sonic3air/commit/2492d1882cd2cf1cc1d7415729ce5c4fd686cd4f",
        "id": "CVE-2026-66733-4ae0b09d",
        "signature_version": "v1",
        "digest": {
            "function_hash": "201862806933562489158426771182967878945",
            "length": 936.0
        },
        "signature_type": "Function",
        "deprecated": false,
        "target": {
            "file": "Oxygen/oxygenengine/source/oxygen_netcore/network/internal/ReceivedPacketCache.cpp",
            "function": "ReceivedPacketCache::enqueuePacket"
        }
    },
    {
        "source": "https://github.com/eukaryot/sonic3air/commit/2492d1882cd2cf1cc1d7415729ce5c4fd686cd4f",
        "id": "CVE-2026-66733-5f31fdce",
        "signature_version": "v1",
        "digest": {
            "function_hash": "214624107761320103734825102895063260335",
            "length": 108.0
        },
        "signature_type": "Function",
        "deprecated": false,
        "target": {
            "file": "Oxygen/oxygenengine/source/oxygen_netcore/network/Sockets.cpp",
            "function": "SocketAddress::getHash"
        }
    },
    {
        "source": "https://github.com/eukaryot/sonic3air/commit/2492d1882cd2cf1cc1d7415729ce5c4fd686cd4f",
        "id": "CVE-2026-66733-7e287ea0",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "94105456853493029998911258996302597367",
                "63951153073804926448237062105875850467",
                "314820088494920991360401392539028298939",
                "175676449311317174797681169043135347611"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "deprecated": false,
        "target": {
            "file": "Oxygen/oxygenengine/source/oxygen_netcore/network/NetConnection.cpp"
        }
    },
    {
        "source": "https://github.com/eukaryot/sonic3air/commit/2492d1882cd2cf1cc1d7415729ce5c4fd686cd4f",
        "id": "CVE-2026-66733-ddbf4148",
        "signature_version": "v1",
        "digest": {
            "function_hash": "95440232860718175500211004756412483721",
            "length": 733.0
        },
        "signature_type": "Function",
        "deprecated": false,
        "target": {
            "file": "Oxygen/oxygenengine/source/oxygen_netcore/network/Sockets.cpp",
            "function": "SocketAddress::assureSockAddr"
        }
    }
]
vanir_signatures_modified 
"2026-08-08T09:11:58Z"