Heap-Based Buffer Overflow in NASA JPL ION-DTN Network Management Daemon

CVE-2026-123999

What is CVE-2026-123999?

NASA JPL's ION-DTN version 3.6.2 through 4.2.0 features a critical flaw within the network management daemon (nm_mgr). This vulnerability stems from improper handling of string formatting, which allows for heap-based buffer overflow. Malicious actors can exploit the issue by sending excessively nested AMP payloads, with the potential for unauthorized out-of-bounds writes occurring due to unbounded strcat operations. Such attacks can lead to crashes of nm_mgr, ultimately disrupting telemetry collection and diminishing operator visibility. Security measures are crucial to mitigate risks associated with oversized AMP transmissions over the UDP CLA/AMP path as well as through local UI interfaces.

References