CVE-2026-9267
tinydtls Out-of-Bounds Read in Certificate Handling
Description
Eclipse tinydtls before commit b3efd41ad111a4920f599f51ffa4f5e9f1e72221 contains an out-of-bounds read vulnerability in the check_server_certificate() function that allows unauthenticated attackers to trigger reads beyond valid buffer boundaries by crafting a Certificate handshake message with a specific fragment_length value. Attackers can exploit missing buffer length validation before uint24 reads, memcmp, and memcpy operations during DTLS epoch 0 on both client and server paths to cause denial of service on memory-constrained devices.
INFO
Published Date :
June 29, 2026, 8:10 a.m.
Last Modified :
June 29, 2026, 8:10 a.m.
Remotely Exploit :
Yes !
Source :
eclipse
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 4.0 | MEDIUM | e51fbebd-6053-4e49-959f-1b94eeb69a2c | ||||
| CVSS 4.0 | MEDIUM | [email protected] |
Solution
- Apply commit b3efd41ad111a4920f599f51ffa4f5e9f1e72221 to tinydtls.
- Validate buffer lengths before memory operations.
- Ensure proper handling of fragment_length values.
- Rebuild and redeploy the affected application.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-9267 vulnerability anywhere in the article.