CVE-2026-66733

Name of the Vulnerable Software and Affected Versions Sonic 3 A.I.R. versions prior to commit 2492d18

Description An unbounded memory allocation issue exists in the ReceivedPacketCache::enqueuePacket() function. Unauthenticated remote attackers can crash the server process by sending a specially crafted UDP packet where the mUniquePacketID variable is set to the maximum uint32 value. Because the mUniquePacketID field is read from the UDP wire-format packet header without bounds checking, the server allocates one CacheItem for every missing packet ID gap. This leads to the exhaustion of available host memory and triggers an uncaught std::bad alloc exception, resulting in a call to std::terminate().

Recommendations Update Sonic 3 A.I.R. to commit 2492d18 or a later version.