CVE-2026-63388
Received Received - Intake

Heap Out-of-Bounds Write in Libevent

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in bufferevent_sock.c when bufferevent_socket_set_conn_address_ copies a kernel-supplied AF_UNIX peer address into bufferevent_private.conn_address. Release builds compiled with NDEBUG disable the EVUTIL_ASSERT length guard, and the evhttp accept path can pass a 110-byte sockaddr from accept() into the 28-byte field. An unauthenticated local peer able to connect to an AF_UNIX listener can overwrite the adjacent dns_request pointer and heap data, causing memory corruption with confidentiality, integrity, and availability impact. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-63388
EUVD
EUVD-2026-63501

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
libevent libevent to 2.1.13 (inc)
libevent libevent to 2.2.2-alpha (inc)
libevent libevent to 2.1.12 (inc)
libevent libevent to 2.2.1-alpha (inc)
libevent libevent 2.1.13
libevent libevent 2.2.2-alpha

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-63388 is a heap out-of-bounds write vulnerability in libevent affecting versions up to 2.1.12 and 2.2.1-alpha. It occurs when libevent is built with NDEBUG, disabling a length guard assertion. An attacker can exploit this by connecting to an AF_UNIX socket listener, causing a 110-byte sockaddr from the kernel to overflow a 28-byte field. This corrupts adjacent heap memory, including critical pointers like dns_request, leading to memory corruption with confidentiality, integrity, and availability impact.

Detection Guidance

To detect CVE-2026-63388, check if your system is running a vulnerable version of libevent (2.1.12 or earlier, or 2.2.1-alpha or earlier) using commands like 'dpkg -l | grep libevent' or 'rpm -qa | grep libevent'. Inspect the build configuration for NDEBUG by examining compilation flags or checking if the binary was compiled with assertions disabled.

Impact Analysis

This vulnerability allows an unauthenticated local attacker to overwrite heap memory adjacent to the buffer, potentially corrupting critical data structures. This can lead to crashes, denial of service, or arbitrary code execution. The impact includes loss of confidentiality, integrity, and availability of affected systems. Exploitation requires local access to the AF_UNIX socket.

Compliance Impact

This vulnerability could lead to unauthorized access, data breaches, or system compromise, violating confidentiality and integrity requirements in GDPR and HIPAA. Organizations using vulnerable libevent versions in systems handling personal or health data may face compliance violations, legal liabilities, and reputational damage due to potential data exposure or service disruption.

Mitigation Strategies

Immediately upgrade libevent to version 2.1.13 or 2.2.2-alpha or later. If upgrading is not possible, disable AF_UNIX socket usage in evhttp servers or ensure builds are compiled with assertions enabled (remove NDEBUG). Monitor for suspicious activity on AF_UNIX sockets.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63388. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart