The vulnerability CVE-2026-76989 affects liftoff-sr CIPster, specifically in the TCP Encapsulation Receive Path component's source code file encap.cc. It results in an out-of-bounds read condition that can be triggered remotely without privileges or user interaction. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. Public disclosure of an exploit exists, but no active exploitation has been confirmed. A patch commit is available to fix the issue, though no official vendor advisory or patch release details are provided in the input data.

Successful exploitation of this vulnerability allows an attacker to perform an out-of-bounds read remotely, which may lead to information disclosure or application instability. The vulnerability does not require authentication or user interaction, increasing its risk. However, there is no evidence of active exploitation in the wild at this time.

A patch identified by commit e8e9dba09bf56962807d3504b783ccdb6287f3e4 is recommended to fix this vulnerability. Since no official vendor advisory or remediation level is provided, users should verify patch availability with the vendor or project repository. Patch status is not yet confirmed — check the vendor advisory or official sources for current remediation guidance.