CVE-2026-112063
Received Received - Intake

Stack-Based Buffer Overflow in libstrophe SCRAM_Hi

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: VulnCheck

Description
libstrophe through 0.14.0 contains a stack-based buffer overflow vulnerability in SCRAM_Hi that allows malicious XMPP servers to overflow a 128-byte stack buffer by sending an oversized SCRAM salt. Attackers can send a server-first-message whose s= attribute decodes to more than 124 bytes, aborting the client or overwriting stack memory in NDEBUG builds.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-112063
EUVD
EUVD-2026-103505

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
strophe libstrophe 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stack-based buffer overflow in libstrophe through version 0.14.0. It occurs in the SCRAM_Hi function where a malicious XMPP server can send an oversized SCRAM salt that decodes to more than 124 bytes. This overflows a 128-byte stack buffer, causing the client to abort or overwrite stack memory, especially in builds without NDEBUG enabled.

Detection Guidance

To detect this vulnerability, check if your system uses libstrophe version 0.14.0 or earlier. Inspect XMPP client logs for crashes or memory corruption during SCRAM authentication. Monitor network traffic for oversized SCRAM salt values in server-first-messages. Use tools like Wireshark to analyze XMPP traffic for malformed SCRAM challenges.

Impact Analysis

This flaw allows attackers to crash the client application or execute arbitrary code by sending specially crafted XMPP server responses. It can also lead to denial of service if the client becomes unresponsive due to memory corruption or excessive processing.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized access or data breaches through stack-based buffer overflows in SCRAM authentication. Exploitable servers could overwrite stack memory or cause client aborts, risking data integrity and confidentiality. GDPR requires protecting personal data integrity and confidentiality, while HIPAA mandates safeguarding protected health information. A successful exploit could violate these requirements.

Mitigation Strategies

Immediately update libstrophe to the latest version beyond 0.14.0. Disable NDEBUG builds if used, as they lack runtime assertions for buffer size checks. Avoid connecting to untrusted XMPP servers. Implement network-level monitoring to block malformed SCRAM challenges. Consider disabling SCRAM authentication temporarily if updates are not feasible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112063. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart