CVE-2026-66732: Eukaryot SONIC3AIR

Medium severity, CVSS 5.9. EPSS: 0.2% chance of exploitation in the next 30 days.

Sonic 3 A.I.R. before commit 2492d18 contains a missing source address validation vulnerability in ConnectionManager where established connections are resolved by a two-byte local connection handle alone without verifying that the datagram source address matches the registered remote address for the connection. An on-path attacker who can observe cleartext UDP traffic can inject arbitrary packets into any established session by forging the two-byte connection identifier, enabling session termination via TerminateConnectionPacket, arbitrary channel message forgery, and forged request responses without requiring IP address spoofing.

Affected products

• Eukaryot SONIC3AIR: up to and including 26.03.28.0

Published 2026-08-06. Last modified 2026-09-24.