vulnti.work

Lakeside SysTrack Agent versions prior to 11.2.1.28, 11.3.0.38, 11.4.0.24, 11.5.0.15 contain an out-of-bounds read vulnerability in the Command ID 30 UDP packet handler that allows remote attackers t…

高危 CVSS 7.5
CVECVE-2026-39929
首次发现2026-07-21 11:15 UTC
披露时间2026-05-28 22:16 UTC
最后更新2026-07-21 11:15 UTC
通道状态auto

摘要

Lakeside SysTrack Agent versions prior to 11.2.1.28, 11.3.0.38, 11.4.0.24, 11.5.0.15 contain an out-of-bounds read vulnerability in the Command ID 30 UDP packet handler that allows remote attackers to crash the application by sending a specially crafted UDP packet. Attackers can send a malformed packet with an invalid memory address at offset 0x4 in the payload to trigger an access violation and cause a denial of service.

中文摘要建设中，暂以英文摘要呈现（DR-003 v2）。

深度研判 · 自动通道

该漏洞尚未生成深度研判报告（DR-003 v2 AI pipeline 建设中）。

Lint 边界警告 (4)

以下是本次研判 lint 阶段发现的非阻塞性警告（如引用 URL 未在白名单内）。这些不影响漏洞条目可用性，仅为透明度披露（参 DR-002）。

  • REF_URL_NOT_ALLOWLISTED url not in allowlist: https://documentation.lakesidesoftware.com/docs/112128-hotfix-agent-release-notes
  • REF_URL_NOT_ALLOWLISTED url not in allowlist: https://documentation.lakesidesoftware.com/docs/1130xxx-hotfix-agent-release-notes
  • REF_URL_NOT_ALLOWLISTED url not in allowlist: https://documentation.lakesidesoftware.com/docs/1140xxx-hotfix-agent-release-notes
  • REF_URL_NOT_ALLOWLISTED url not in allowlist: https://documentation.lakesidesoftware.com/docs/1150xxx-hotfix-agent-release-notes

数据来源

  • NVD DATABASE

原始链接

时间线

  1. nvd_ingest NVD