CVE-2026-55246: bincookie: Heap buffer overflow via unvalidated `num_pages` when parsing a `.binarycookies` file
bincookie is a header-only binarycookies parser. Prior to 0.1.9, bincookieinitfile() in bincookie.h allocates a buffer using the actual .binarycookies file length but trusts the file-controlled numpages field as the loop bound for byte-swapping pagesizes entries. A crafted file can make the loop read and write beyond the heap allocation, and related unvalidated page sizes and cookieoffsets can drive additional out-of-bounds accesses in page and cookie iteration. Applications that parse an attacker-supplied binarycookies file may crash or suffer heap corruption that can potentially enable code execution. This issue is fixed in version 0.1.9.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bincookieto a version that resolves this vulnerability.Fixed in 0.1.9
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using bincookie versions before 0.1.9 are exposed when they parse attacker-supplied .binarycookies files. The vulnerable code is in bincookie_init_file() in the header-only parser.
What does an attacker need to exploit the vulnerability?
An attacker needs to convince the application to parse a crafted .binarycookies file. No privileges are required, but user interaction is required according to the supplied severity vector.
What is the impact of a successful exploit?
A crafted file can cause reads and writes beyond a heap allocation, leading to crashes or heap corruption. The heap corruption may potentially enable code execution.
What should be done if updating is not immediately possible?
Do not parse untrusted .binarycookies files until the application can use bincookie 0.1.9 or later. Restricting parsing to trusted files reduces exposure.
How can I determine whether my application is affected?
Check whether the application includes or uses bincookie and whether its version is earlier than 0.1.9. Applications that call bincookie_init_file() on externally supplied .binarycookies files are particularly affected.