CVE-2026-63383: Libevent: decode_tag_internal() can lead to out-of-bounds read
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in eventtagging.c when decodetaginternal requests at most five bytes from evbufferpullup but iterates using the full logical buffer length. A fragmented evbuffer containing a six-byte malformed tag can therefore advance past the pullup window and trigger an out-of-bounds read, which can crash a process that decodes attacker-controlled tagged RPC data. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libeventto a version that resolves this vulnerability.Fixed in 2.1.13 - Upgrade
Upgrade
libeventto a version that resolves this vulnerability.Fixed in 2.2.2-alpha
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Processes using affected libevent versions are exposed if they decode attacker-controlled tagged RPC data. Exploitation specifically requires the input to be held in a fragmented evbuffer.
What does an attacker need to send to trigger the flaw?
The attacker needs to supply a fragmented evbuffer containing a malformed six-byte tag. This causes tag decoding to advance beyond the contiguous data returned by evbuffer_pullup.
What is the likely impact of successful exploitation?
The out-of-bounds read can crash the process performing the decode. The provided information does not establish impacts beyond a process crash.
How can I determine whether an installed version is fixed?
The issue is fixed in libevent 2.1.13 and 2.2.2-alpha. Versions prior to 2.1.13 and 2.2.2-alpha are affected.