CVE-2026-63383
Received Received - Intake

Out-of-Bounds Read in Libevent Event Tagging

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in event_tagging.c when decode_tag_internal requests at most five bytes from evbuffer_pullup but iterates using the full logical buffer length. A fragmented evbuffer containing a six-byte malformed tag can therefore advance past the pullup window and trigger an out-of-bounds read, which can crash a process that decodes attacker-controlled tagged RPC data. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-63383
EUVD
EUVD-2026-63502

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
libevent libevent to 2.2.2-alpha (exc)
libevent libevent to 2.1.13 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds read in the libevent library's decode_tag_internal function. It occurs when processing a malformed tag in a fragmented evbuffer. The function requests only 5 contiguous bytes but iterates using the full logical buffer length, causing it to read beyond the intended buffer. This can crash processes handling attacker-controlled tagged RPC data.

Detection Guidance

To detect this vulnerability, check the version of libevent installed on your system. Run: libevent_version. If the version is below 2.1.13 or 2.2.2-alpha, the system is vulnerable. Additionally, monitor for crashes or memory corruption errors in applications using libevent, particularly those handling RPC data.

Impact Analysis

An attacker could exploit this to crash applications using libevent, potentially leading to denial-of-service. If the application processes untrusted RPC data, the attacker might read sensitive memory contents, though no direct code execution is mentioned.

Mitigation Strategies

Immediately update libevent to version 2.1.13 or 2.2.2-alpha or later. If updating is not possible, restrict network access to applications using libevent, especially those processing RPC data. Disable or isolate services relying on vulnerable versions until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63383. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart