Executive Summary

CVE-2026-4750 is an out-of-bounds read vulnerability found in the Woof project, specifically in the `clone` function within the `src/m_scanner.c` file. This function was originally cloned from GNU Aspell/Aspell but did not include a critical security patch that fixed a similar issue (CVE-2019-17544). The vulnerability occurs due to improper handling of trailing backslashes in the scanner code, which can cause the program to read memory outside the intended bounds, leading to memory safety issues.

The issue is addressed by applying the same patch used in GNU Aspell/Aspell to prevent out-of-bounds reads in the `Unescape()` function, ensuring that input is properly handled to avoid accessing memory beyond allocated limits.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to serious security risks because it allows an attacker to cause an out-of-bounds read, which may result in memory safety issues such as information disclosure or application crashes.

Given the CVSS v3.1 base score of 9.1 with high impact on confidentiality and availability, an attacker could exploit this vulnerability remotely without any privileges or user interaction, potentially leading to sensitive data exposure or denial of service.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

The vulnerability is an out-of-bounds read in the `clone` function within the `src/m_scanner.c` file of the Woof project, triggered by improper handling of trailing backslashes in input to the scanner code.

Detection would involve monitoring or analyzing inputs processed by the Woof scanner, especially those containing trailing backslashes that could trigger the out-of-bounds read.

However, no specific detection commands or network/system scanning commands are provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to update Woof to version 15.3.0 or later, where the security fix addressing this out-of-bounds read vulnerability has been applied.

The fix involves applying the patch that prevents out-of-bounds reads in the `Unescape()` function, ensuring proper handling of input to the scanner.

If updating is not immediately possible, avoid processing inputs with trailing backslashes that could trigger the vulnerability.

Useful 0 Not Useful 0