CVE-2026-102507: Sliver 1.7.7 Denial of Service via PE Parser Slice Bounds in Operator RPC
Sliver C2 framework version 1.7.7 and earlier contains an unhandled panic vulnerability in the operator gRPC handler that allows an attacker controlling a compromised implant to crash the entire teamserver by returning a malformed or empty Download response. Attackers can send zero-length or 1-3 byte data payloads through a hostile implant session to trigger an out-of-bounds slice access in the vendored Binject library's BinaryMagic function, which propagates unrecovered through the operator gRPC interceptor chain and terminates the server process, affecting all connected operators.
Affected Software
Event History
Frequently Asked Questions
Who can trigger the denial of service?
An attacker must control a compromised implant session and return a malformed or empty Download response. This is not described as an unauthenticated attack against the teamserver directly; the affected path is the operator gRPC handler processing implant-controlled data.
What payloads are known to cause the crash?
Zero-length payloads and payloads between one and three bytes can trigger the out-of-bounds slice access in the vendored Binject library's BinaryMagic function.
What is the operational impact of successful exploitation?
The unrecovered panic terminates the entire teamserver process. All connected operators are affected by the resulting service outage.
Which versions are affected?
Sliver C2 framework version 1.7.7 and earlier are affected.