CVE-2026-39929: Lakeside SysTrack Agent LsiAgent.exe Out-of-Bounds Read via UDP

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-28 · updated 2026-07-21
Weakness: CWE-125

Description

Lakeside SysTrack Agent versions prior to 11.2.1.28, 11.3.0.38, 11.4.0.24, 11.5.0.15 contain an out-of-bounds read vulnerability in the Command ID 30 UDP packet handler that allows remote attackers to crash the application by sending a specially crafted UDP packet. Attackers can send a malformed packet with an invalid memory address at offset 0x4 in the payload to trigger an access violation and cause a denial of service.

Affected products

Lakeside Software, LLC. SysTrack Agent: before 11.2.1.28; from 11.3.0.xxx before 11.3.0.38; from 11.4.0.xxx before 11.4.0.24; from 11.5.0.xxx before 11.5.0.15 — fixed in 11.2.1.28, 11.3.0.38, 11.4.0.24, 11.5.0.15

How to fix

Upgrade to a fixed version: Lakeside Software, LLC. SysTrack Agent 11.2.1.28, 11.3.0.38, 11.4.0.24, 11.5.0.15. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-39929 or the next vulnerability affects your stack