CVE-2026-76989: Out-of-Bounds Read in liftoff-sr CIPster

This vulnerability in liftoff-sr CIPster (commit 1802525be27d33e19a9a83c163e331a1d13b1892) is an out-of-bounds read in the TCP Encapsulation Receive Path component, specifically in an unknown function of source/src/enet_encap/encap.cc. The vulnerability allows remote attackers to read memory outside the intended bounds, potentially leading to information disclosure or application instability. The exploit has been publicly disclosed but no active exploitation in the wild is currently known. A patch with identifier e8e9dba09bf56962807d3504b783ccdb6287f3e4 is available to fix the issue.

The vulnerability allows remote attackers to perform an out-of-bounds read, which may lead to information disclosure or application crashes. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and low impact on availability. There is no confirmed active exploitation in the wild at this time.

A patch identified by commit e8e9dba09bf56962807d3504b783ccdb6287f3e4 is available and should be deployed to remediate this vulnerability. No other mitigation or temporary workaround is indicated.