Integer Overflow Vulnerability in NASA JPL ION-DTN Product

CVE-2026-124001

What is CVE-2026-124001?

The ION-DTN software, developed by NASA JPL, contains an integer overflow vulnerability within the Datagram Retransmission convergence layer. This weakness allows attackers to exploit the dgr_receive API by sending specially crafted 64-bit svcDataLength values, which can lead to a miscalculation in the 32-bit allocation size. The result of this flaw is an unchecked memcpy operation that can trigger an out-of-bounds write, potentially causing heap memory corruption. Exploit scenarios may include denial of service attacks or even remote code execution via synthetic datagrams or DGR traffic over custom transports.

References