CVE-2026-112063: libstrophe through 0.14.0 Stack-Based Buffer Overflow via SCRAM Salt in SCRAM_Hi
libstrophe through 0.14.0 contains a stack-based buffer overflow vulnerability in SCRAMHi that allows malicious XMPP servers to overflow a 128-byte stack buffer by sending an oversized SCRAM salt. Attackers can send a server-first-message whose s= attribute decodes to more than 124 bytes, aborting the client or overwriting stack memory in NDEBUG builds.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Clients using libstrophe through version 0.14.0 that perform SCRAM authentication with an XMPP server are exposed. A malicious XMPP server can trigger the flaw by supplying an oversized salt in its SCRAM server-first message.
What must an attacker do to exploit the vulnerability?
The attacker needs to act as, control, or cause the client to connect to a malicious XMPP server, then send a server-first message whose s= value decodes to more than 124 bytes. The CVSS vector indicates no client privileges are required, but user interaction is required.
What is the likely impact in debug versus NDEBUG builds?
An oversized SCRAM salt can abort the client. In NDEBUG builds, it can also overwrite stack memory, which makes the impact more serious than a simple client termination.