CVE-2026-39929 is an out-of-bounds read vulnerability affecting the SysTrack Agent by Lakeside Software, LLC. The issue is triggered by sending a malformed UDP packet with an invalid memory address at a specific offset in the payload to the Command ID 30 handler. This causes an access violation leading to a denial of service by crashing the application. The vulnerability affects multiple versions prior to 11.2.1.28, 11.3.0.38, 11.4.0.24, and 11.5.0.15. The CVSS 4.0 base score is 8.7, indicating high severity, with attack vector network, no required privileges, and no user interaction needed. No known exploits are reported in the wild, and no official patch or remediation level has been disclosed.

Successful exploitation results in a denial of service condition by crashing the SysTrack Agent application remotely without requiring authentication or user interaction. This could disrupt monitoring or management functions provided by the SysTrack Agent on affected systems. There is no indication of code execution or data disclosure from the available information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider restricting or monitoring UDP traffic to the SysTrack Agent, especially packets targeting Command ID 30 handlers, to reduce exposure. No official remediation or temporary fix has been documented.