External risk intelligence

illumos SCTP Kernel Heap Corruption Leading to Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-15422

The vulnerability resides in the SCTP protocol stack and is reachable over the network. While it allows unauthenticated remote code execution, SCTP is typically used for specialized signaling or telecommunications traffic rather than general-purpose web services, making internet-wide exposure possible but not a default configuration for most standard systems.

Out-of-bounds Write

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability within the illumos operating system's SCTP protocol handling. A weakness in how association requests are processed could allow an unauthenticated remote attacker to execute code on the system, potentially impacting the availability and integrity of services running on affected illumos distributions.

Flaw allows remote code execution via malformed network packets.
Critical vulnerability in network protocol handling.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker on the network can send a specially crafted SCTP packet to trigger a vulnerability in the illumos SCTP inbound path. This occurs before security checks are performed, allowing the attacker to manipulate address parameters in an INIT ACK chunk. This manipulation can lead to an out-of-bounds access and kernel heap corruption, potentially enabling remote code execution.

Entry condition: Network access required.
Trigger point: Malformed SCTP INIT ACK packet.
Resulting risk: Kernel heap corruption and code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated remote attacker to cause kernel heap corruption, potentially leading to remote code execution. This occurs when the system processes malformed SCTP INIT ACK packets before integrity checks are performed.

Kernel memory corruption.
Malformed SCTP packets.
Remote code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The illumos SCTP inbound path is vulnerable to an out-of-bounds access and kernel heap corruption due to inadequate validation of address parameters in INIT ACK chunks. This could lead to remote code execution. Ownership likely lies with the platform or infrastructure teams responsible for the illumos operating system, with initial triage involving confirming the presence and reachability of vulnerable systems and identifying accountable owners to plan risk-based remediation.

Platform/infrastructure teams own the issue.
Verify SCTP reachability and business criticality.
Plan remediation based on confirmed exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the illumos SCTP vulnerability?

This vulnerability is a critical flaw within the illumos kernel's SCTP protocol stack. It involves improper validation of address parameters when processing inbound INIT ACK chunks. Because the system performs association lookups before applying essential integrity checks or security policies, the component is susceptible to memory corruption from remote, unauthenticated network traffic.

How do CWE-122 and CWE-787 apply here?

These identifiers classify the flaw as heap-based buffer overflows. Specifically, the kernel fails to verify the size and validity of data within incoming SCTP packets. This negligence causes an out-of-bounds memory access, ultimately leading to heap corruption that an attacker can leverage to gain remote code execution capabilities on the host system.

What triggers this kernel heap corruption?

The flaw is triggered when an attacker sends a specially crafted SCTP INIT ACK packet to a target system. Crucially, the vulnerability exists because the association lookup occurs during early packet classification. This scope allows the malicious payload to bypass standard SCTP integrity protections and IPsec policies, reaching vulnerable code paths before security gates can intervene.

Is this SCTP issue reachable?

Yes, according to the Halo Surface Signal, this vulnerability is reachable over the network with a 'Possible' likelihood score. While SCTP is often confined to telecommunications or specialized signaling rather than common web traffic, the protocol remains accessible to remote attackers, necessitating a thorough assessment of network exposure for all illumos-based infrastructure.

How should teams respond to this flaw?

Infrastructure teams should first inventory systems running illumos to identify those utilizing the SCTP stack. Verification of SCTP reachability is essential to prioritize remediation. Once exposed assets are mapped, teams must plan for the application of the official security patch to address the underlying input validation deficiency and secure the kernel heap against further manipulation.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.