{"id":"CVE-2026-88357","title":"nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code","summary":"nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code. Specially crafted network input can cause byte-buffer addresses at odd offsets to be cast to uint16_t or wider integer pointers and direc…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-1335"],"published":"2026-09-24","updated":"2026-09-24","sourceUpdated":"2026-09-24T18:19:05.410","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88357","references":[{"url":"https://github.com/ntop/nDPI/issues/3213","label":"cve@mitre.org"},{"url":"https://github.com/ntop/nDPI/pull/3231","label":"cve@mitre.org"},{"url":"https://github.com/utoni/nDPI/commit/6698f14bf6025394a537fe23f413cf79e9d13594","label":"cve@mitre.org"},{"url":"https://github.com/utoni/nDPI/commit/694231bb43ff21f452fbc2b53fcf6cdc9a99f75f","label":"cve@mitre.org"},{"url":"https://github.com/utoni/nDPI/commit/6ce1280c52ed52a97332c3fe58fd2b47b867ec6e","label":"cve@mitre.org"},{"url":"https://github.com/utoni/nDPI/commit/8fc3b439920021a77165f8aee4f81b25bc88629e","label":"cve@mitre.org"},{"url":"https://github.com/ntop/nDPI/issues/3213","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-24T17:52:11.193406Z"},"ingestedAt":"2026-09-24T15:45:56.660Z","slug":"CVE-2026-88357","body":"## Overview\n\nnDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code. Specially crafted network input can cause byte-buffer addresses at odd offsets to be cast to uint16_t or wider integer pointers and directly dereferenced without alignment checks. This results in undefined behavior and can cause process termination in UBSan-instrumented builds or on strict-alignment architectures, leading to denial of service.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":210316,"id":"CVE-2026-88357","ts":1790275813278,"field":"exploit_available","old":"false","new":"true"},{"seq":210315,"id":"CVE-2026-88357","ts":1790275813278,"field":"cvss","old":null,"new":"7.5"},{"seq":210314,"id":"CVE-2026-88357","ts":1790275813278,"field":"severity","old":"none","new":"high"}]}