CVE-2026-39929
High
Description
Lakeside SysTrack Agent versions prior to 11.2.1.28, 11.3.0.38, 11.4.0.24, 11.5.0.15 contain an out-of-bounds read vulnerability in the Command ID 30 UDP packet handler that allows remote attackers to crash the application by sending a specially crafted UDP packet. Attackers can send a malformed packet with an invalid memory address at offset 0x4 in the payload to trigger an access violation and cause a denial of service.
SeverityHigh
CVSS7.5
Exploit probability—
ProductSysTrack Agent
PublishedMay 28, 2026
First seenMay 28, 2026
Weakness typeCWE-125Out-of-bounds readCWE-754CWE-754
How to fix
Update
- Lakeside Software, LLC. SysTrack Agent11.2.1.28, 11.3.0.38, 11.4.0.24, 11.5.0.15 or later
Patches
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Lakeside Software, LLC. SysTrack Agent | v < 11.2.1.28, 11.3.0.xxx ≤ v < 11.3.0.38, 11.4.0.xxx ≤ v < 11.4.0.24, 11.5.0.xxx ≤ v < 11.5.0.15 | 11.2.1.28, 11.3.0.38, 11.4.0.24, 11.5.0.15 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.