The illumos SCTP inbound path performs an association lookup for INIT ACK chunks without adequately validating the address parameters embedded in the chunk. Because this lookup occurs during packet classification—before SCTP integrity checks or IPsec policy are applied—a remote, unauthenticated attacker can send a crafted SCTP INIT ACK packet with malformed address parameters, resulting in an out‑of‑bounds memory access and kernel heap corruption that may lead to remote code execution. The flaw represents a classic buffer overflow and out‑of‑bounds read (CWE-122 and CWE-787).

CVE-2026-15422 affects all OmniOS, Triton Data Center SmartOS, and illumos distributions that are based on illumos‑gate prior to commit 53a3efdeff8e6745bbfb69c5360f94962fb79e75, the commit that contains the fix for issue 18117. Any distribution derived from the illumos‑gate code base before this patch is considered vulnerable.

The vulnerability carries a CVSS score of 9.1, indicating critical severity, while the EPSS score of less than 1% suggests a very low probability of exploitation at any given time. It is not listed in the CISA KEV catalog. The attack vector is remote, unauthenticated, and requires crafting a specific SCTP INIT ACK packet with malformed address parameters. No host privileges or user interaction are needed; the flaw can be triggered from anywhere over the network that can reach the affected system.