Stack-Based Buffer Overflow Vulnerability in libstrophe by Strophe
CVE-2026-112063

6MEDIUM

Key Information:

Vendor

Strophe

Status
Libstrophe
Vendor
CVE Published:
18 October 2026

What is CVE-2026-112063?

libstrophe, up to version 0.14.0, is susceptible to a stack-based buffer overflow in the SCRAM_Hi function. This vulnerability can be exploited by malicious XMPP servers that send an oversized SCRAM salt, allowing them to overflow a 128-byte stack buffer. An attacker can craft a server-first-message with an 's=' attribute that decodes to more than 124 bytes, which may lead to client application crashes, potential fortification of stack memory, or other undefined behaviors in NDEBUG builds. Users of libstrophe should take precautionary measures to mitigate the risks associated with this vulnerability.

Affected Version(s)

libstrophe 0 <= 0.14.0

References

https://hackmd.io/@haindpwn/libstrophe-scram-salt-stack-o...
third-party-advisory
https://github.com/strophe/libstrophe/blob/0.14.0/src/scr...
technical-description
https://github.com/strophe/libstrophe/blob/0.14.0/src/sasl.c
technical-description

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.