CVE-2026-86107: Arista Networks VeloCloud, грешка в паметта

Описание

Оригинално описание

The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated overlay neighbors. This vulnerability impacts the VeloCloud VCMP tunnel protocol only. A successful exploit can cause the affected process to terminate and restart, leading to a temporary disruption of traffic. Hosts on the internet that are unauthenticated and unable to form an overlay peer relationship can not trigger the vulnerable logic.

Засегнати продукти

• Arista Networks VeloCloud: 1.0.0.0 преди 5.2.0.0; 5.2.0.0 преди 5.2.7.0; 6.1.0.0 преди 6.1.5.0; 6.4.0.0 преди 6.4.2.0
• Arista Networks VeloCloud Gateway: 1.0.0.0 преди 5.2.0.0; 5.2.0.0 преди 5.2.7.0; 6.1.0.0 преди 6.1.5.0; 6.4.0.0 преди 6.4.2.0

Вид слабост

• CWE-787 Out-of-bounds Write

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-86107
• https://nvd.nist.gov/vuln/detail/CVE-2026-86107
• https://www.arista.com/en/support/advisories-notices/security-advisory/24736-security-advisory-0180