CVE-2026-5264

CVE-2026-5264 is a heap buffer overflow vulnerability in DTLS 1.3 ACK message processing that allows a remote attacker to trigger a crash or potentially execute arbitrary code by sending a specially crafted ACK message. The specific affected products are not detailed in the available data, but this vulnerability impacts systems utilizing DTLS 1.3 protocol implementations. The vulnerability presents a moderate risk with a FAUCET Risk Score of 50.0 out of 100, though precise CVSS metrics are not yet available. The attack requires only network access with no special privileges or user interaction, making it remotely exploitable. However, the extremely low EPSS score of 0.002410000 indicates this vulnerability is currently ranked lower in probability of exploitation compared to the vast majority of known CVEs. Regarding exploitation status, there is no evidence of active real-world exploitation, as the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog and remains inactive on threat intelligence hot lists. No publicly available exploit code has been documented in the accessible vulnerability databases at this time.