{"id":"CVE-2026-66732","summary":"Sonic 3 A.I.R. Missing Source Address Validation in ConnectionManager","details":"Sonic 3 A.I.R. before commit 2492d18 contains a missing source address validation vulnerability in ConnectionManager where established connections are resolved by a two-byte local connection handle alone without verifying that the datagram source address matches the registered remote address for the connection. An on-path attacker who can observe cleartext UDP traffic can inject arbitrary packets into any established session by forging the two-byte connection identifier, enabling session termination via TerminateConnectionPacket, arbitrary channel message forgery, and forged request responses without requiring IP address spoofing.","modified":"2026-08-08T09:31:03.992634Z","published":"2026-08-06T12:53:54.287Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-346"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66732.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66732.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66732"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/sonic-3-a-i-r-missing-source-address-validation-in-connectionmanager"},{"type":"FIX","url":"https://github.com/Eukaryot/sonic3air/commit/2492d1882cd2cf1cc1d7415729ce5c4fd686cd4f"},{"type":"PACKAGE","url":"https://github.com/Eukaryot/sonic3air"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/eukaryot/sonic3air","events":[{"introduced":"0"},{"fixed":"2492d1882cd2cf1cc1d7415729ce5c4fd686cd4f"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"26.03.28.0"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v26.07.12.1-test","v26.07.12.0-test","v26.03.28.0-stable","v26.02.28.0-preview","v26.02.15.0-test","v26.01.31.0-test","v25.12.31.0-test","v25.02.15.0-test","v25.01.12.0-test","v24.12.05.0-test","v24.02.02.0-stable","v24.07.10.0-test","v24.07.04.0-test","v24.06.21.0-test","v24.06.18.0-test","v24.01.07.0-test","v23.11.18.0-preview","v23.11.12.1-test","v23.11.12.0-test","v23.11.10.0-test","v23.10.07.0-test","v23.08.27.0-test","v23.05.15.0-test","v23.03.25.0-test","v23.01.15.0-test","v22.12.15.0-test","v22.09.10.0-stable","v22.08.21.0-test","v22.08.13.0-test","v22.08.07.1-test","v22.08.07.0-test","v22.07.31.2-test","v22.07.31.1-test","v22.07.31.0-test","v22.07.03.0-test","v22.05.08.0-test","v22.04.23.0-test","v22.02.13.0-test","v22.01.23.0-test","v22.01.09.0-test"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-66732.json","vanir_signatures_modified":"2026-08-08T09:31:03Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["5624269680463886541978609279046594914","113450266477642467652392381767348629255","265849690712191467488726053524699705356","199503416601196331675274615284417748377","24784534590711869764212393912763385756","97843941489644147753669932705155221666","174540928961572168315894195503679722389","307006705126550402605959469252017724328","154152364725688658533241597911988867344","119865447882420075017914182348125323222","192379465815436829383656936558971060737","176817287069271452291342913829984989980","231171884091473056702722056888789858179","6945945582830893975894810877027749634","238340518585325406655036294365488942755","85582494031904366808406485418653847482","163828376546612963030571360055303866177","295741022074362885055039303208974027155","64582105038791240902091810384458987881","291514188009471059391024439867472939745","63755804739504920850204013462762052899","241973660486813502268554719092557388333","198593738289238799625256313502009181105","207136618007815250439169271721192944069","109094317342919296048247602639432377130","237543941712230074845647762987496038779","48140445616269931838788412720451209900","157872978560267765362912420770110001929","52011510920533487466137751541255849736","95692779903927848971268983716855502695","58701232737614812382421533945417428093","286918447046360830493292785104504471387","40856273045921600128068534627337159797","22222448686072509863923440452983485212","73713763492245466607352799007430157615"],"threshold":0.9},"id":"CVE-2026-66732-1969cc06","signature_type":"Line","signature_version":"v1","source":"https://github.com/eukaryot/sonic3air/commit/2492d1882cd2cf1cc1d7415729ce5c4fd686cd4f","target":{"file":"Oxygen/oxygenengine/source/oxygen_netcore/network/Sockets.h"}},{"id":"CVE-2026-66732-2883fa31","signature_type":"Line","signature_version":"v1","source":"https://github.com/eukaryot/sonic3air/commit/2492d1882cd2cf1cc1d7415729ce5c4fd686cd4f","target":{"file":"Oxygen/oxygenengine/source/oxygen_netcore/network/Sockets.cpp"},"deprecated":false,"digest":{"line_hashes":["106148897609971401461335324462421687163","29101072999000660969070660476539499783","172682873690776996683776613443171523071","71847648258394871467504416681431825398","246204507088019104491813715177118131089","60989298919135612879046068298280039310","82822685724548525988730417116442587817","65217390983847098952155933968214115905","101821120613116055118867431352797414050","136810297561117529852730839070157214524","121985383051649742833258574397465921425","123372937239023054320918328678565826989","156731648916598397232480607899858555038","232471586807000710114046075674421501941","160675400118146787162808151710075401988","49457923558925955669802178036133163502","239413101416173747421090575412397198343","21273665248998299177551512231210381518","157460208416030603296069898713269913753","196039366430857431229938103739888556438","52269975576401845203244021771583348629","252228815023104129019808073954336948657"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"205709479392261448933544942036354580278","length":2663},"id":"CVE-2026-66732-2c0c2b8c","signature_type":"Function","signature_version":"v1","source":"https://github.com/eukaryot/sonic3air/commit/2492d1882cd2cf1cc1d7415729ce5c4fd686cd4f","target":{"file":"Oxygen/oxygenengine/source/oxygen_netcore/network/NetConnection.cpp","function":"NetConnection::handleLowLevelPacket"}},{"digest":{"line_hashes":["106835449887000219390244930032682842911","207343679462306720240145401057237030096","176959296752975491830868836135546854678"],"threshold":0.9},"id":"CVE-2026-66732-47e7b6f0","signature_type":"Line","signature_version":"v1","source":"https://github.com/eukaryot/sonic3air/commit/2492d1882cd2cf1cc1d7415729ce5c4fd686cd4f","target":{"file":"Oxygen/oxygenengine/source/oxygen_netcore/network/internal/ReceivedPacketCache.cpp"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/eukaryot/sonic3air/commit/2492d1882cd2cf1cc1d7415729ce5c4fd686cd4f","target":{"file":"Oxygen/oxygenengine/source/oxygen_netcore/network/internal/ReceivedPacketCache.cpp","function":"ReceivedPacketCache::enqueuePacket"},"deprecated":false,"digest":{"function_hash":"201862806933562489158426771182967878945","length":936},"id":"CVE-2026-66732-4ae0b09d"},{"deprecated":false,"digest":{"function_hash":"214624107761320103734825102895063260335","length":108},"id":"CVE-2026-66732-5f31fdce","signature_type":"Function","signature_version":"v1","source":"https://github.com/eukaryot/sonic3air/commit/2492d1882cd2cf1cc1d7415729ce5c4fd686cd4f","target":{"file":"Oxygen/oxygenengine/source/oxygen_netcore/network/Sockets.cpp","function":"SocketAddress::getHash"}},{"deprecated":false,"digest":{"line_hashes":["94105456853493029998911258996302597367","63951153073804926448237062105875850467","314820088494920991360401392539028298939","175676449311317174797681169043135347611"],"threshold":0.9},"id":"CVE-2026-66732-7e287ea0","signature_type":"Line","signature_version":"v1","source":"https://github.com/eukaryot/sonic3air/commit/2492d1882cd2cf1cc1d7415729ce5c4fd686cd4f","target":{"file":"Oxygen/oxygenengine/source/oxygen_netcore/network/NetConnection.cpp"}},{"target":{"file":"Oxygen/oxygenengine/source/oxygen_netcore/network/Sockets.cpp","function":"SocketAddress::assureSockAddr"},"deprecated":false,"digest":{"function_hash":"95440232860718175500211004756412483721","length":733},"id":"CVE-2026-66732-ddbf4148","signature_type":"Function","signature_version":"v1","source":"https://github.com/eukaryot/sonic3air/commit/2492d1882cd2cf1cc1d7415729ce5c4fd686cd4f"}]}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"}]}