Vulnerability · Published Aug 6, 2026 · Assigned by VulnCheck

CVE-2026-66733Sonic 3 A.I.R. Unbounded Memory Allocation DoS via ReceivedPacketCache

High 7.5

In plain English

A high-severity security flaw in sonic3air from Eukaryot. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 75% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)1.6%top 24.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Sonic 3 A.I.R. before commit 2492d18 contains an unbounded memory allocation vulnerability in ReceivedPacketCache::enqueuePacket() that allows unauthenticated remote attackers to crash the server process by sending a crafted UDP packet with mUniquePacketID set to the maximum uint32 value. The mUniquePacketID field is read directly from the UDP wire-format packet header without bounds checking, causing the server to allocate one CacheItem per missing packet ID gap, exhausting available host memory and propagating an uncaught std::bad_alloc exception to std::terminate().

Affected products (as reported)

Vendor	Product	Versions
Eukaryot	sonic3air	0 – through 26.03.28.0

Weakness: CWE-789 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Patch Commit patch
https://www.vulncheck.com/advisories/sonic-3-a-i-r-unbounded-memory-allocation-dos-via-receivedpacketcache third-party-advisory