GnuTLS DTLS Heap Overflow (CVE-2026-33846) Poses Remote Threat

A critical heap buffer overflow vulnerability, identified as CVE-2026-33846, has been reported in the GnuTLS DTLS handshake fragment reassembly logic. According to the National Vulnerability Database, the flaw resides within the merge_handshake_packet() function. This function fails to adequately validate the consistency of the message_length field across multiple DTLS handshake fragments belonging to the same logical message.

Attackers can exploit this by crafting malicious DTLS fragments with conflicting message_length values. The implementation may allocate a buffer based on a smaller initial fragment, only to subsequently write beyond its allocated bounds when processing larger, inconsistent fragments. This leads to an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication, directly through the DTLS handshake path, and carries a CVSSv3.1 score of 7.5 (HIGH), indicating a severe risk of application crashes or potential memory corruption.

While specific affected products are not detailed by the National Vulnerability Database, any application or system relying on GnuTLS for DTLS communication is potentially at risk. Defenders must recognize that this is a remote, unauthenticated vector, making it a prime target for opportunistic attacks. The attacker’s calculus here is low effort, high impact: a simple, malformed packet can take down a critical service or worse, open doors to deeper memory manipulation.