CVE-2026-63381: Libevent: Dangling Pointer in `evbuffer_add_buffer_reference`
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbufferaddbufferreference processes an output buffer whose outtotallen is zero. evbufferfreeallchains frees the initial empty chain without resetting outbuf->first, outbuf->last, or outbuf->lastwithdatap, and APPENDCHAINMULTICAST subsequently dereferences the dangling chain pointer. A caller that can drive this buffer state can cause memory corruption or a process crash. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libeventto a version that resolves this vulnerability.Fixed in 2.1.13 - Upgrade
Upgrade
libeventto a version that resolves this vulnerability.Fixed in 2.2.2-alpha
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using Libevent versions earlier than 2.1.13 or 2.2.2-alpha are affected if their application can reach evbuffer_add_buffer_reference with an output buffer whose out_total_len is zero.
What does an attacker or caller need to trigger the issue?
They need to be able to drive Libevent into the specific buffer state where evbuffer_add_buffer_reference processes an output buffer with zero out_total_len. In that state, a freed initial empty chain can later be dereferenced.
What should be done if the affected code path is in use?
Update Libevent to 2.1.13 or 2.2.2-alpha, which contain the fix. The provided information does not identify another mitigation.
How can I assess whether an application may be affected?
Check the Libevent version in use and review whether the application invokes evbuffer_add_buffer_reference on output buffers that can have out_total_len equal to zero. Affected versions combined with that reachable state may result in memory corruption or a process crash.