CVE-2026-9267

Name of the Vulnerable Software and Affected Versions Eclipse tinydtls versions prior to commit b3efd41ad111a4920f599f51ffa4f5e9f1e72221

Description An out-of-bounds read occurs in the check server certificate() function when processing a Certificate handshake message. Unauthenticated attackers can trigger reads beyond valid buffer boundaries by providing a specific fragment length value. This is possible due to missing buffer length validation before uint24 reads, memcmp, and memcpy operations during DTLS epoch 0 on both client and server paths, which can lead to a denial of service on memory-constrained devices.

Recommendations Update to the version containing commit b3efd41ad111a4920f599f51ffa4f5e9f1e72221.