CVE-2026-56123: socat 1.8.0.0 - 1.8.1.1 Heap Buffer Overflow via SOCKS5 Reply Parser
Last updated 6 July 2026
Other sources
socat versions 1.8.0.0 through 1.8.1.1 contain a heap-based buffer overflow vulnerability that allows a malicious SOCKS5 proxy server to overwrite adjacent heap memory by exploiting a sign-extension flaw in the DOMAINNAME reply parser. During connection setup, the domain name length byte is read through a signed char field causing a negative bytestoread value that is implicitly converted to sizet, resulting in an unbounded heap write into the 262-byte reply buffer with attacker-controlled size and content.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/socatto a version that resolves this vulnerability.Fixed in 1.8.1.3-2 - Compensating control
If you must keep using an affected socat version (1.8.0.0 through 1.8.1.1), avoid connecting through untrusted/malicious SOCKS5 proxy servers because the issue is exploitable by a malicious SOCKS5 proxy that crafts attacker-controlled DOMAINNAME reply data.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56123?
CVE-2026-56123 has a severity rating of 9.2, which is classified as critical.
How do I fix CVE-2026-56123?
To fix CVE-2026-56123, upgrade socat to version 1.8.1.2 or later.
What types of attacks can exploit CVE-2026-56123?
CVE-2026-56123 can be exploited by a malicious SOCKS5 proxy server using a specially crafted reply.
What is the impact of CVE-2026-56123?
The impact of CVE-2026-56123 includes the potential for arbitrary code execution through heap memory manipulation.
Which versions of socat are affected by CVE-2026-56123?
CVE-2026-56123 affects socat versions 1.8.0.0 through 1.8.1.1.