Heap Out-of-Bounds Write in Libevent Affects Local Unix Domain Socket Connections
CVE-2026-63388
What is CVE-2026-63388?
Libevent, an event notification library, has a vulnerability due to a heap out-of-bounds write in the file bufferevent_sock.c. This occurs when the function bufferevent_socket_set_conn_address_ improperly handles a kernel-supplied AF_UNIX peer address. Release builds with NDEBUG disable certain assertions, allowing a local attacker to connect to an AF_UNIX listener and supply an oversized sockaddr, leading to possible memory corruption. The adjacent dns_request pointer and heap data can be overwritten, impacting the confidentiality, integrity, and availability of the system. Users are advised to upgrade to versions 2.1.13 or 2.2.2-alpha to mitigate this issue.
Affected Version(s)
libevent < 2.1.13 < 2.1.13
libevent >= 2.2.0-alpha, < 2.2.2-alpha < 2.2.0-alpha, 2.2.2-alpha