---
id: CVE-2026-66733
title: Sonic 3 A.I.R
summary: >-
  Sonic 3 A.I.R. before commit 2492d18 contains an unbounded memory allocation
  vulnerability in ReceivedPacketCache::enqueuePacket() that allows
  unauthenticated remote attackers to crash the server process by sending a
  crafted UDP packet w…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-789
published: '2026-08-06'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:43:32.537'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-66733'
references:
  - url: >-
      https://github.com/Eukaryot/sonic3air/commit/2492d1882cd2cf1cc1d7415729ce5c4fd686cd4f
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/sonic-3-a-i-r-unbounded-memory-allocation-dos-via-receivedpacketcache
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.01552
epssPercentile: 0.74024
ingestedAt: '2026-09-24T20:51:40.184Z'
---

## Overview

Sonic 3 A.I.R. before commit 2492d18 contains an unbounded memory allocation vulnerability in ReceivedPacketCache::enqueuePacket() that allows unauthenticated remote attackers to crash the server process by sending a crafted UDP packet with mUniquePacketID set to the maximum uint32 value. The mUniquePacketID field is read directly from the UDP wire-format packet header without bounds checking, causing the server to allocate one CacheItem per missing packet ID gap, exhausting available host memory and propagating an uncaught std::bad_alloc exception to std::terminate().

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.