CVE-2026-84484

ION-DTN versions before 4.2.0 contain an out-of-bounds read vulnerability (CWE-125) in the decodeSdnv function, which parses Self-Delimiting Numeric Values (SDNVs). An unauthenticated remote attacker can trigger it by sending a UDP datagram to the LTP (Licklider Transmission Protocol) link service input port containing a truncated SDNV, causing the parser to read up to nine bytes past buffer boundaries and to underflow byte counters. The CVSS 4.0 vector scores the impact as high availability impact on the vulnerable system (VC:N/VI:N/VA:H), so the practical risk is disruption or crash of the LTP link service rather than a scored information disclosure. Any operator running ION-DTN prior to 4.2.0 with an LTP link service reachable over UDP is affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and EPSS estimates only a 0.5% probability of exploitation in the next 30 days.

What to do: Upgrade ION-DTN to version 4.2.0 or later, which resolves the decodeSdnv out-of-bounds read. Until upgraded, restrict the LTP link service input UDP port to trusted mission or research peers via firewall/ACL rules so unauthenticated datagrams cannot reach the parser. Operators should audit their deployments to confirm whether LTP over UDP is exposed beyond a trusted network.