Sonic 3 A.I.R. contains an unbounded memory allocation flaw in ReceivedPacketCache::enqueuePacket() that allows an unauthenticated remote attacker to crash the server process by sending a crafted UDP packet with mUniquePacketID set to the maximum uint32 value. The mUniquePacketID field is read directly from the UDP wire-format packet header without bounds checking, causing the server to allocate a CacheItem for each missing packet ID gap, exhausting host memory and triggering an uncaught std::bad_alloc exception that terminates the process. This flaw is a classic unbounded memory allocation weakness (CWE‑789) and results in a denial of service rather than arbitrary code execution.

The affected product is Sonic 3 A.I.R. from the vendor Eukaryot. Versions prior to commit 2492d188 are vulnerable. No specific product version numbers are listed, but any build before the introduction of the fix at that commit is impacted.

The vulnerability carries a CVSS score of 8.7, indicating high severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog, so no published exploitation evidence exists. The attack vector is inferred to be a crafted UDP packet sent over the network, requiring no authentication. The impact is a forced crash of the server process, causing a service outage until the process is restarted or the vulnerability is remediated.