CVE-2026-66733: Eukaryot SONIC3AIR

High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days.

Sonic 3 A.I.R. before commit 2492d18 contains an unbounded memory allocation vulnerability in ReceivedPacketCache::enqueuePacket() that allows unauthenticated remote attackers to crash the server process by sending a crafted UDP packet with mUniquePacketID set to the maximum uint32 value. The mUniquePacketID field is read directly from the UDP wire-format packet header without bounds checking, causing the server to allocate one CacheItem per missing packet ID gap, exhausting available host memory and propagating an uncaught std::bad_alloc exception to std::terminate().

Affected products

• Eukaryot SONIC3AIR: up to and including 26.03.28.0

Published 2026-08-06. Last modified 2026-09-24.