WS-2026-0041

SctpSackChunk.ParseChunk reads the numGapAckBlocks and numDuplicateTSNs fields, each up to 65535, directly from an attacker-controlled SCTP SACK chunk and loops that many times reading four bytes per iteration, with no validation of the counts against the chunk length or the receive buffer. A...