Vulnerability · Published May 28, 2026 · Assigned by VulnCheck
CVE-2026-39929Lakeside SysTrack Agent LsiAgent.exe Out-of-Bounds Read via UDP
High 7.5
In plain English
A high-severity out-of-bounds read in SysTrack Agent from Lakeside Software, LLC.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities).
Official description
Lakeside SysTrack Agent versions prior to 11.2.1.28, 11.3.0.38, 11.4.0.24, 11.5.0.15 contain an out-of-bounds read vulnerability in the Command ID 30 UDP packet handler that allows remote attackers to crash the application by sending a specially crafted UDP packet. Attackers can send a malformed packet with an invalid memory address at offset 0x4 in the payload to trigger an access violation and cause a denial of service.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Lakeside Software, LLC. | SysTrack Agent | 0 – before 11.2.1.2811.3.0.xxx – before 11.3.0.3811.4.0.xxx – before 11.4.0.2411.5.0.xxx – before 11.5.0.15 |
Weakness: CWE-125, CWE-754 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://documentation.lakesidesoftware.com/docs/112128-hotfix-agent-release-notes release-notes, patch
- https://documentation.lakesidesoftware.com/docs/1130xxx-hotfix-agent-release-notes release-notes, patch
- https://documentation.lakesidesoftware.com/docs/1140xxx-hotfix-agent-release-notes release-notes, patch
- https://documentation.lakesidesoftware.com/docs/1150xxx-hotfix-agent-release-notes release-notes, patch
- https://www.vulncheck.com/advisories/lakeside-systrack-agent-lsiagent-exe-out-of-bounds-read-via-udp third-party-advisory