When processing an IP packet with an option size (2nd byte after the option) of 39, it will crash due to an off-by-one error. The maximum available size for the whole IP options field is 40, and two bytes are already used. Checks are done to validate that the option size field is less than 40, but a value of 39 is not checked properly. This vulnerability does not affect all options and is dependent on the underlying protocol.