CVE-2026-8369

Improper Input Validation in OpenThread NAT64 Translator

State: Published
Severity: 6.0 Medium
Published: May 13, 2026
Updated: May 13, 2026
Reserved: May 11, 2026

Description

Improper Input Validation in the NAT64 translator in The OpenThread Authors OpenThread before commit 26a882d on all platforms allows an attacker on the adjacent IPv4 network to inject corrupted IPv6 packets into the Thread mesh or bypass security checks via crafted IPv4 packets with options.

Scores

CVSS	Score	Vector	Source
4.0	6.0 Medium	CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N	Google

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
OpenThreadThe OpenThread Authors	commit 26a882dAffected

References

https://github.com/openthread/openthread/pull/12818

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.