Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-39929— Lakeside SysTrack Agent LsiAgent.exe Out-of-Bounds Read via UDP

Quick assessment

Affected
Lakeside Software, LLC. SysTrack Agent
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Lakeside SysTrack Agent是美国Lakeside公司的一个用于采集终端设备性能与用户体验数据的代理组件。 Lakeside SysTrack Agent存在代码问题漏洞，该漏洞源于Command ID 30 UDP数据包处理程序存在越界读取，可能导致远程攻击者通过发送特制UDP数据包触发访问违规并导致应用程序崩溃。以下版本受到影响：11.2.1.28之前版本、11.3.0.38之前版本、11.4.0.24之前版本和11.5.0.15之前版本。

CVSS 7.5 · High EPSS 1.94% · P80

Affected Version Matrix 4

VendorProduct Version RangeStatus
Lakeside Software, LLC. SysTrack Agent < 11.2.1.28 affected
11.3.0.xxx< 11.3.0.38 affected
11.4.0.xxx< 11.4.0.24 affected
11.5.0.xxx< 11.5.0.15 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-39929

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Lakeside SysTrack Agent LsiAgent.exe Out-of-Bounds Read via UDP
Source: CVE Program / CVE List V5
Vulnerability Description
Lakeside SysTrack Agent versions prior to 11.2.1.28, 11.3.0.38, 11.4.0.24, 11.5.0.15 contain an out-of-bounds read vulnerability in the Command ID 30 UDP packet handler that allows remote attackers to crash the application by sending a specially crafted UDP packet. Attackers can send a malformed packet with an invalid memory address at offset 0x4 in the payload to trigger an access violation and cause a denial of service.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5
Vulnerability Title
Lakeside SysTrack Agent 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Lakeside SysTrack Agent是美国Lakeside公司的一个用于采集终端设备性能与用户体验数据的代理组件。 Lakeside SysTrack Agent存在代码问题漏洞，该漏洞源于Command ID 30 UDP数据包处理程序存在越界读取，可能导致远程攻击者通过发送特制UDP数据包触发访问违规并导致应用程序崩溃。以下版本受到影响：11.2.1.28之前版本、11.3.0.38之前版本、11.4.0.24之前版本和11.5.0.15之前版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Lakeside Software, LLC. SysTrack Agent 0 ~ 11.2.1.28 -

II. Public POCs for CVE-2026-39929

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-39929

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-39929 (1)

Vendor Advisories for CVE-2026-39929 (1)

Vendor Pages for CVE-2026-39929 (2)

Other References for CVE-2026-39929 (1)

IV. Related Vulnerabilities

Same product: SysTrack Agent
Same weakness: CWE-125

V. Comments for CVE-2026-39929

No comments yet

Leave a comment