CVE-2026-39929: Lakeside SysTrack Agent LsiAgent.exe Out-of-Bounds Read via UDP

Synopsis

An out-of-bounds read vulnerability exists in the Lakeside SysTrack Agent (LsiAgent.exe) UDP packet handler for Command ID 30. The service is reachable over the network with no authentication required, and a remote attacker can trigger the flaw by sending a single malformed UDP packet containing an invalid memory address at payload offset 0x4. Successful exploitation crashes the SysTrack Agent process, causing a denial of service. Patched-image rebuilds at versions 11.2.1.28, 11.3.0.38, 11.4.0.24, and 11.5.0.15 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the SysTrack Agent UDP listener over the network; no local or physical access to the host is needed.

• AuthenticationNot required

  No credentials or session token are needed; the vulnerable UDP handler accepts unauthenticated packets.

• Victim interactionNot required

  Exploitation is fully one-sided; no user on the target system needs to open a file, click a link, or take any other action.

• Attack complexityDetail

  Exploit reliability is high and condition-free; crafting the malformed UDP payload requires no race condition, specific memory layout, or timing window.

Blast Radius

• Crashes the LsiAgent.exe process on the target host, terminating all SysTrack Agent monitoring and data-collection functions.
• Disrupts endpoint telemetry and workspace analytics gathered by SysTrack, creating visibility gaps for IT and operations teams.
• No confidentiality or integrity impact is indicated; stored data and system configuration are not read or modified by this exploit.