CVE-2026-63388

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63388", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-16T17:39:30.171Z", "datePublished": "2026-08-20T17:44:18.435Z", "dateUpdated": "2026-08-21T21:46:40.675Z"}, "containers": {"cna": {"title": "Libevent: Heap out-of-bounds write in bufferevent_socket_set_conn_address_ reachable via AF_UNIX accept", "problemTypes": [{"descriptions": [{"cweId": "CWE-617", "lang": "en", "description": "CWE-617: Reachable Assertion", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-787", "lang": "en", "description": "CWE-787: Out-of-bounds Write", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/libevent/libevent/security/advisories/GHSA-cvq5-vrvr-j338", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/libevent/libevent/security/advisories/GHSA-cvq5-vrvr-j338"}, {"name": "https://github.com/libevent/libevent/commit/52057cb33d0c20c0a0453fbabe6c0c96854931b9", "tags": ["x_refsource_MISC"], "url": "https://github.com/libevent/libevent/commit/52057cb33d0c20c0a0453fbabe6c0c96854931b9"}, {"name": "https://github.com/libevent/libevent/commit/ef38f926e9cd1f082416c6fff13587bc1f431d72", "tags": ["x_refsource_MISC"], "url": "https://github.com/libevent/libevent/commit/ef38f926e9cd1f082416c6fff13587bc1f431d72"}, {"name": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable", "tags": ["x_refsource_MISC"], "url": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable"}, {"name": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha", "tags": ["x_refsource_MISC"], "url": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha"}], "affected": [{"vendor": "libevent", "product": "libevent", "versions": [{"version": "< 2.1.13", "status": "affected"}, {"version": ">= 2.2.0-alpha, < 2.2.2-alpha", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-20T17:44:18.435Z"}, "descriptions": [{"lang": "en", "value": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in bufferevent_sock.c when bufferevent_socket_set_conn_address_ copies a kernel-supplied AF_UNIX peer address into bufferevent_private.conn_address. Release builds compiled with NDEBUG disable the EVUTIL_ASSERT length guard, and the evhttp accept path can pass a 110-byte sockaddr from accept() into the 28-byte field. An unauthenticated local peer able to connect to an AF_UNIX listener can overwrite the adjacent dns_request pointer and heap data, causing memory corruption with confidentiality, integrity, and availability impact. This issue is fixed in versions 2.1.13 and 2.2.2-alpha."}], "source": {"advisory": "GHSA-cvq5-vrvr-j338", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-21T21:00:24.903079Z", "id": "CVE-2026-63388", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T21:46:40.675Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63388", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-21T21:00:24.903079Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T21:00:26.544Z"}}], "cna": {"title": "Libevent: Heap out-of-bounds write in bufferevent_socket_set_conn_address_ reachable via AF_UNIX accept", "source": {"advisory": "GHSA-cvq5-vrvr-j338", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "libevent", "product": "libevent", "versions": [{"status": "affected", "version": "< 2.1.13"}, {"status": "affected", "version": ">= 2.2.0-alpha, < 2.2.2-alpha"}]}], "references": [{"url": "https://github.com/libevent/libevent/security/advisories/GHSA-cvq5-vrvr-j338", "name": "https://github.com/libevent/libevent/security/advisories/GHSA-cvq5-vrvr-j338", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/libevent/libevent/commit/52057cb33d0c20c0a0453fbabe6c0c96854931b9", "name": "https://github.com/libevent/libevent/commit/52057cb33d0c20c0a0453fbabe6c0c96854931b9", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/libevent/libevent/commit/ef38f926e9cd1f082416c6fff13587bc1f431d72", "name": "https://github.com/libevent/libevent/commit/ef38f926e9cd1f082416c6fff13587bc1f431d72", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable", "name": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha", "name": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in bufferevent_sock.c when bufferevent_socket_set_conn_address_ copies a kernel-supplied AF_UNIX peer address into bufferevent_private.conn_address. Release builds compiled with NDEBUG disable the EVUTIL_ASSERT length guard, and the evhttp accept path can pass a 110-byte sockaddr from accept() into the 28-byte field. An unauthenticated local peer able to connect to an AF_UNIX listener can overwrite the adjacent dns_request pointer and heap data, causing memory corruption with confidentiality, integrity, and availability impact. This issue is fixed in versions 2.1.13 and 2.2.2-alpha."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-617", "description": "CWE-617: Reachable Assertion"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787: Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-20T17:44:18.435Z"}}}, "cveMetadata": {"cveId": "CVE-2026-63388", "state": "PUBLISHED", "dateUpdated": "2026-08-21T21:46:40.675Z", "dateReserved": "2026-07-16T17:39:30.171Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-20T17:44:18.435Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "libevent", "vendor": "libevent", "versions": [{"status": "affected", "version": "< 2.1.13"}, {"status": "affected", "version": ">= 2.2.0-alpha, < 2.2.2-alpha"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in bufferevent_sock.c when bufferevent_socket_set_conn_address_ copies a kernel-supplied AF_UNIX peer address into bufferevent_private.conn_address. Release builds compiled with NDEBUG disable the EVUTIL_ASSERT length guard, and the evhttp accept path can pass a 110-byte sockaddr from accept() into the 28-byte field. An unauthenticated local peer able to connect to an AF_UNIX listener can overwrite the adjacent dns_request pointer and heap data, causing memory corruption with confidentiality, integrity, and availability impact. This issue is fixed in versions 2.1.13 and 2.2.2-alpha."}, {"lang": "es", "value": "Libevent es una biblioteca de notificaci\u00f3n de eventos. Antes de las versiones 2.1.13 y 2.2.2-alpha, libevent tiene una escritura fuera de l\u00edmites en el heap en bufferevent_sock.c cuando bufferevent_socket_set_conn_address_ copia una direcci\u00f3n de par AF_UNIX suministrada por el kernel en bufferevent_private.conn_address. Las compilaciones de lanzamiento compiladas con NDEBUG deshabilitan la protecci\u00f3n de longitud EVUTIL_ASSERT, y la ruta de aceptaci\u00f3n de evhttp puede pasar una sockaddr de 110 bytes de accept() al campo de 28 bytes. Un par local no autenticado capaz de conectarse a un oyente AF_UNIX puede sobrescribir el puntero dns_request adyacente y los datos del heap, causando corrupci\u00f3n de memoria con impacto en la confidencialidad, integridad y disponibilidad. Este problema est\u00e1 corregido en las versiones 2.1.13 y 2.2.2-alpha."}], "id": "CVE-2026-63388", "lastModified": "2026-10-26T10:10:00.140", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63388", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-21T21:00:24.903079Z", "version": "2.0.3"}}]}, "published": "2026-08-20T18:16:36.893", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/libevent/libevent/commit/52057cb33d0c20c0a0453fbabe6c0c96854931b9"}, {"source": "security-advisories@github.com", "url": "https://github.com/libevent/libevent/commit/ef38f926e9cd1f082416c6fff13587bc1f431d72"}, {"source": "security-advisories@github.com", "url": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable"}, {"source": "security-advisories@github.com", "url": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha"}, {"source": "security-advisories@github.com", "url": "https://github.com/libevent/libevent/security/advisories/GHSA-cvq5-vrvr-j338"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-617"}, {"lang": "en", "value": "CWE-787"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling", "id": "2520661", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520661"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in bufferevent_sock.c when bufferevent_socket_set_conn_address_ copies a kernel-supplied AF_UNIX peer address into bufferevent_private.conn_address. Release builds compiled with NDEBUG disable the EVUTIL_ASSERT length guard, and the evhttp accept path can pass a 110-byte sockaddr from accept() into the 28-byte field. An unauthenticated local peer able to connect to an AF_UNIX listener can overwrite the adjacent dns_request pointer and heap data, causing memory corruption with confidentiality, integrity, and availability impact. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.", "A flaw was found in Libevent. A heap out-of-bounds write vulnerability in the `bufferevent_socket_set_conn_address_` function allows an unauthenticated local peer to achieve arbitrary code execution. By connecting to an AF_UNIX listener, an attacker can overwrite critical heap data, leading to memory corruption and potentially full control over the affected system. This can severely impact the confidentiality, integrity, and availability of data and services."], "name": "CVE-2026-63388", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "libevent", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Affected", "package_name": "libevent", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Affected", "package_name": "libevent2", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "libevent", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "libevent", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "libevent", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "libevent", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-08-20T17:44:18Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63388\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63388\nhttps://github.com/libevent/libevent/commit/52057cb33d0c20c0a0453fbabe6c0c96854931b9\nhttps://github.com/libevent/libevent/commit/ef38f926e9cd1f082416c6fff13587bc1f431d72\nhttps://github.com/libevent/libevent/releases/tag/release-2.1.13-stable\nhttps://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha\nhttps://github.com/libevent/libevent/security/advisories/GHSA-cvq5-vrvr-j338"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.1.13)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.2.0-alpha,2.2.2-alpha)"}}], "enrichment": {"confidence": 81.0, "confidence_source": "matching", "scores": [{"score": 81.0, "source": "matching"}]}, "original": {"product": "libevent", "source": "cna", "vendor": "libevent"}, "product": "libevent", "vendor": "libevent_project"}], "created": "2026-08-21T02:00:05.423922+00:00", "updated": "2026-08-21T13:01:20.103347+00:00", "vendors": ["libevent_project", "libevent_project$PRODUCT$libevent"]}