CVE WatchAug 21, 2026

CVE-2026-15813

A vulnerability was found in the network packet de-fragmentation engine of kronosnet (Version affected <= 1.34). The internal reassembly cod

CVSS

6.5

Medium

EPSS

0.4%

p30

KEV

—

Exploit Today

0-100

Published: Jul 20, 2026 · Last modified: Aug 21, 2026 · CWE-787

EPSS · 30d

0.3%EPSS · 30 days0.4%

2026-08-202026-09-17

Technical description

A vulnerability was found in the network packet de-fragmentation engine of kronosnet (Version affected <= 1.34). The internal reassembly code does not properly validate sequence numbers of incoming payload fragments. An attacker can exploit this lack of verification by transmitting malformed packets with corrupted sequence parameters. Under specific conditions, this forces the packet processing layer to parse data outside the designated bounds of the internal memory structures, causing an out-of-bounds memory access or heap corruption. This behavior can result in sudden application crashes or system instability.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-252807.8 HIG

1.5%

——0Memory corruption when processing escape handling flow with insufficient user buffer sizes.1d CVE-2026-240747.8 HIG

5.8%

——2Memory Corruption when processing data with large offset and length values exceeds buffer limits during data copy operations.1d CVE-2026-240737.8 HIG

5.8%

——2Memory corruption when processing decode statistics due to insufficient validation of offset against structure size.1d CVE-2026-927867.8 HIG

2.7%

——1LightGBM through 4.7.0 fails to validate child and split array values when parsing text models, allowing attackers to write out-of-bounds memory during SHAP prediction. Attackers can craft malicious model files with invalid node references that trigger out-of-bounds writes at attacker-chosen offsets in the leaf_depth_ buffer during feature contribution computation.2d CVE-2026-91097—

50.4%

——15HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.2d CVE-2026-861075.9 MED

28.6%

——9The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated overlay neighbors. This vulnerability impacts the VeloCloud VCMP tunnel protocol only. A successful exploit can cause the affected process to terminate and restart, leading to a temporary disruption of traffic. Hosts on the internet that are unauthenticated and unable to form an overlay peer relationship can not trigger the vulnerable logic.2d