CVE-2026-84484: ION-DTN Buffer Overflow Vulnerability

CVE-2026-84484 Overview

CVE-2026-84484 is an out-of-bounds read vulnerability [CWE-125] in NASA JPL's Interplanetary Overlay Network (ION-DTN) implementation of the Delay/Disruption Tolerant Networking (DTN) protocol. Versions before 4.2.0 contain a flaw in the decodeSdnv function, which parses Self-Delimiting Numeric Values (SDNVs) without checking remaining buffer length. Unauthenticated remote attackers can send a UDP datagram with a truncated SDNV to the Licklider Transmission Protocol (LTP) link service input port. The malformed input drives reads up to nine bytes past buffer boundaries and causes byte counter underflow.

Critical Impact
Remote unauthenticated attackers can trigger out-of-bounds memory reads and counter underflow in ION-DTN nodes over UDP, potentially causing service disruption in spacecraft and DTN gateway deployments.

Affected Products

NASA JPL ION-DTN versions prior to 4.2.0
Deployments exposing the LTP link service input port over UDP
DTN gateways and nodes running vulnerable ici/library components

Discovery Timeline

2026-09-02 - CVE-2026-84484 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84484

Vulnerability Analysis

The vulnerability resides in the decodeSdnv function in ION-DTN's ici/library component. SDNV is a variable-length integer encoding used throughout Bundle Protocol and LTP, where each octet's high-order bit signals continuation. decodeSdnv consumes octets until it finds one with a cleared high-order bit, without any bounds argument.

When a caller passes buffer content received from an untrusted convergence-layer adapter, an attacker-controlled SDNV whose octets all have the continuation bit set forces the loop to read past the end of the buffer. The function can advance up to ten octets (the maximum SDNV length), causing reads up to nine bytes beyond valid memory. Callers that subtract the consumed length from a remaining-bytes counter then underflow that counter, corrupting subsequent parser state.

Root Cause

The root cause is missing length delimitation in decodeSdnv. Upstream documentation confirms the function is unbounded and assumes the buffer contains a complete, well-formed SDNV. Callers in the LTP receive path invoked it against network-supplied input without validating that the encoded SDNV terminates within the packet.

Attack Vector

An unauthenticated remote attacker sends a single UDP datagram to the LTP link service input port. The datagram contains a truncated SDNV whose bytes all have the high-order continuation bit set, with no terminating octet. Reachability requires only network access to the LTP UDP port; no credentials, user interaction, or prior state are needed.

// Patch: change sdnvLength type to size_t to safely accumulate against remaining input
 	uvast		recordsCounter;
 	size_t		payloadLength;
 	size_t		remainingLength;
-	int		sdnvLength;
+	size_t		sdnvLength;
 	char		skipTopic = 0;		/*	Boolean		*/
 	VSap		*vsap = 0;		/*	To hush gcc	*/
 	PsmAddress	elt;

Source: ION-DTN commit d52d22b. The fix introduces decodeSdnvBounded(), which accepts a length argument capping the octets it may read and returns 0 when the SDNV is truncated within that window.

Detection Methods for CVE-2026-84484

Indicators of Compromise

Inbound UDP datagrams to LTP link service ports containing byte sequences with successive octets whose high bit is set and no terminating octet with cleared high bit
Crashes, hangs, or abnormal counter values in ltpclock, ltpdeliv, or related ION daemons following external UDP traffic
Log entries showing malformed LTP segments or DTPC record parsing failures

Detection Strategies

Deploy network-layer signatures on LTP UDP ports that flag SDNV runs exceeding 10 octets or lacking a termination byte within packet bounds
Monitor ION-DTN process telemetry for segmentation faults, address sanitizer alerts, or memory read errors in decodeSdnv call sites
Compare ION-DTN binary versions against the fixed 4.2.0 release across the fleet

Monitoring Recommendations

Enable verbose LTP and DTPC logging and forward parser-error events to a centralized log platform for correlation
Baseline expected LTP peers and alert on UDP traffic to ION nodes from unexpected sources
Track upstream advisories at GHSA-85pw-28vw-2jf7 and the VulnCheck advisory for exploitation reports

How to Mitigate CVE-2026-84484

Immediate Actions Required

Upgrade all ION-DTN instances to ION-DTN 4.2.0 or later
Inventory nodes exposing LTP UDP link service ports and restrict them to authorized peer address ranges
Audit downstream forks and integrations for private uses of decodeSdnv on untrusted input and migrate them to decodeSdnvBounded

Patch Information

The fix is delivered in ION-DTN 4.2.0 via commit d52d22b. The patch introduces decodeSdnvBounded(uvast *value, unsigned char *sdnvText, size_t length), which never reads at or past sdnvText + length and returns 0 on truncated input. Call sites that ingest network-sourced SDNVs, including LTP and DTPC receive paths, are converted to use the bounded variant. Local sdnvLength accumulators were widened from int to size_t to prevent underflow when subtracted from remaining-length counters.

Workarounds

Block UDP traffic to LTP link service ports at the network perimeter and permit only trusted DTN peers
Terminate untrusted DTN traffic at a proxy that validates SDNV framing before forwarding to ION-DTN
If patching is deferred, disable the LTP UDP link service on nodes that do not require external DTN connectivity

bash

# Example: restrict LTP UDP link service to trusted peer using iptables
iptables -A INPUT -p udp --dport 1113 -s <trusted_peer_ip> -j ACCEPT
iptables -A INPUT -p udp --dport 1113 -j DROP

# Verify installed ION-DTN version is 4.2.0 or later
ionadmin
# then within the prompt:
#   v