Memory Corruption Vulnerability in Bincookie by Tatsh

CVE-2026-55246

What is CVE-2026-55246?

The Bincookie library, which is utilized for parsing binary cookie files, suffers from a memory corruption vulnerability. The issue arises when the function bincookie_init_file() does not properly validate the num_pages field from the .binarycookies file, leading to potential buffer overflows. An attacker can craft a malicious binary cookies file that causes the loop to read and write beyond allocated memory boundaries. This may result in crashes, heap corruption, or even arbitrary code execution in applications that process such affected files. Users are advised to update to version 0.1.9 or later to mitigate the vulnerability.

References