Vulnerability details
CVE-2026-15422
OmniOS OmniOSTriton Data Center SmartOSillumos illumos-gate
SCTP needs to better-check INIT ACK chunk parameters
CVSS 4.0
9.1Critical
Official description
The illumos SCTP inbound path performs association lookup for INIT ACK chunks without adequately validating the address parameters carried in the chunk. Since this lookup runs during packet classification (i.e. before SCTP integrity checks or IPsec policy are applied) a remote, unauthenticated attacker can send a crafted SCTP INIT ACK packet with malformed address parameters to cause an out-of-bounds access and kernel heap corruption, which may lead to remote code execution. The flaw has existed since 2010 (illumos-gate commit a5407c02), and affects any illumos distribution prior to illumos-gate commit 53a3efde.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.1Critical | 4.0 | CVEProject cvelistV5 (CNA) (illumos) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/S:P/AU:Y/R:U/V:C/RE:H/U:Red |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| OmniOS | OmniOS | any ≤ v < r151054 | CVEProject cvelistV5 (CNA) |
| OmniOS | OmniOS | r151054 ≤ v < r151054bj | CVEProject cvelistV5 (CNA) |
| OmniOS | OmniOS | r151056 ≤ v < r151056aj | CVEProject cvelistV5 (CNA) |
| OmniOS | OmniOS | r151058 ≤ v < r151058j | CVEProject cvelistV5 (CNA) |
| Triton Data Center | SmartOS | any ≤ v < 202060709 | CVEProject cvelistV5 (CNA) |
| illumos | illumos-gate | a5407c02d5ed61b29481b9b71f1307d7ebec9e5c ≤ v < 53a3efdeff8e6745bbfb69c5360f94962fb79e75 | CVEProject cvelistV5 (CNA) |
References and advisories
3
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-07-16
- Last updated
- 2026-07-17
- State
- Published
- Assigner (CNA)
- illumos
Exploit prediction (EPSS)
0.88%
Probability of exploitation in 30 days
59.3%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-122Heap-based buffer overflow
- CWE-787Out-of-bounds write