CVE-2026-76987
Received Received - Intake

Memory Corruption in Liftoff-SR CIPster

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: VulDB

Description
A security flaw has been discovered in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. The impacted element is the function CipAttribute::GetAttrData/CipAttribute::SetAttrData of the file ciptypes.h of the component Generic Attribute Logic. Performing a manipulation results in memory corruption. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The patch is named e745d9d4a8ca3a13689066983a1269fe1e567674. It is suggested to install a patch to address this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-76987
EUVD
EUVD-2026-63322

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
liftoff-sr cipster From 1802525be27d33e19a9a83c163e331a1d13b1892 (inc)
liftoff-sr cipster *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a memory corruption issue in the liftoff-sr CIPster project. It occurs in the CipAttribute::GetAttrData/CipAttribute::SetAttrData function of ciptypes.h due to improper handling of byte-array attribute lengths. Attackers can manipulate the length value to cause buffer over-reads or writes, leading to memory corruption. The flaw stems from using a ByteBuf without capacity tracking, allowing malicious length values via SetAttributeSingle requests.

Detection Guidance

Detecting this vulnerability requires checking for vulnerable versions of liftoff-sr CIPster. Inspect the ciptypes.h file for the CipAttribute::GetAttrData/CipAttribute::SetAttrData functions. Verify if the patch e745d9d4a8ca3a13689066983a1269fe1e567674 is applied. Monitor network traffic for SetAttributeSingle requests with manipulated byte-array lengths.

Impact Analysis

This vulnerability allows remote attackers to execute arbitrary code or cause denial-of-service conditions by triggering memory corruption. It could lead to system crashes, data leaks, or unauthorized access depending on the application's use of CIPster. The exploit is public, increasing the risk of attacks.

Compliance Impact

This vulnerability could lead to unauthorized data access or disclosure, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Organizations using CIPster may face compliance violations if exploited, resulting in legal penalties or reputational damage.

Mitigation Strategies

Immediately apply the patch e745d9d4a8ca3a13689066983a1269fe1e567674 from the CIPster repository. Ensure all instances of CipByteArray use the new structure with immutable capacity. Validate SetAttributeSingle requests to reject oversized length values. Monitor for out-of-bounds memory access attempts in logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76987. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart