VULNERABILITY INTELLIGENCE

CVE-2026-88357

CVSS score7.5 HIGH
EPSS probability0.60%
CISA KEVNot currently listed
Published2026-09-24
Last modified2026-09-24
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Description

nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code. Specially crafted network input can cause byte-buffer addresses at odd offsets to be cast to uint16_t or wider integer pointers and directly dereferenced without alignment checks. This results in undefined behavior and can cause process termination in UBSan-instrumented builds or on strict-alignment architectures, leading to denial of service.

Weakness classification

  • 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-1335

Primary references