CVE-2026-39929

Vulnerability

Lakeside SysTrack Agent versions prior to 11.2.1.28, 11.3.0.38, 11.4.0.24, and 11.5.0.15 contain an out-of-bounds read vulnerability in the Command ID 30 UDP packet handler. The flaw occurs when processing a specially crafted UDP packet with an invalid memory address at offset 0x4 in the payload, triggering an access violation that crashes the application [1]. The affected component is the LsiAgent.exe loopback handler (or similar named module) within the SysTrack agent [2][3].

Exploitation

An attacker can send a malformed UDP packet to the SysTrack agent from any network position (no authentication required). The packet must contain an invalid memory address at payload offset 0x4, causing the handler to dereference an out-of-bounds pointer and crash the agent process [1]. No user interaction or race condition is needed; the attack is purely remote and immediate.

Impact

Successful exploitation causes a denial of service: the SysTrack agent application crashes, disrupting endpoint monitoring and data collection. The crash is limited to the agent process itself; no privilege escalation or data disclosure occurs [1][2]. The impact is confined to availability loss for the affected system.

Mitigation

Fixed versions are 11.2.1.28, 11.3.0.38, 11.4.0.24, and 11.5.0.15 as published in hotfix release notes [1][2][3]. Users should upgrade to these or later versions. No workaround is documented; the fix addresses the malformed UDP packet handling in the loopback component.