Out-of-Bounds Read Vulnerability in Libevent Affects Event Notification Library

CVE-2026-63383

What is CVE-2026-63383?

Libevent, an event notification library, contains a vulnerability where it can read beyond a contiguous evbuffer region. In versions prior to 2.1.13 and 2.2.2-alpha, a malformed six-byte tag can potentially lead to an out-of-bounds read during the processing of tagged RPC data. This vulnerability might crash processes that decode this attacker-controlled data. The issue has been addressed in subsequent releases, including 2.1.13 and 2.2.2-alpha, ensuring better security and stability.

References