CVE-2026-39929: Lakeside Software, Llc Systrack Agent

High severity, CVSS 7.5. EPSS: 1.9% chance of exploitation in the next 30 days.

Lakeside SysTrack Agent versions prior to 11.2.1.28, 11.3.0.38, 11.4.0.24, 11.5.0.15 contain an out-of-bounds read vulnerability in the Command ID 30 UDP packet handler that allows remote attackers to crash the application by sending a specially crafted UDP packet. Attackers can send a malformed packet with an invalid memory address at offset 0x4 in the payload to trigger an access violation and cause a denial of service.

Affected products

• Lakeside Software, Llc Systrack Agent: before 11.2.1.28 (fixed in 11.2.1.28); from 11.3.0.xxx, before 11.3.0.38 (fixed in 11.3.0.38); from 11.4.0.xxx, before 11.4.0.24 (fixed in 11.4.0.24); from 11.5.0.xxx, before 11.5.0.15 (fixed in 11.5.0.15)

Published 2026-05-28. Last modified 2026-07-21.