CVE-2026-102712

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description During the first DTLS ClientHello, the parser copies a device-claimed session id length and validates the ciphersuite-list length against the total record length rather than the remaining bytes. This allows an unauthenticated peer to trigger an Out-of-Bounds (OOB) source read of up to 255 bytes. These bytes are then echoed verbatim into the outgoing ServerHello, resulting in the disclosure of adjacent process memory over the network. A variant of this issue can also cause a crash upon receiving the first packet.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.