CVE-2026-63388: Libevent: Heap out-of-bounds write in bufferevent_socket_set_conn_address_ reachable via AF_UNIX accept
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in buffereventsock.c when buffereventsocketsetconnaddress copies a kernel-supplied AFUNIX peer address into buffereventprivate.connaddress. Release builds compiled with NDEBUG disable the EVUTILASSERT length guard, and the evhttp accept path can pass a 110-byte sockaddr from accept() into the 28-byte field. An unauthenticated local peer able to connect to an AFUNIX listener can overwrite the adjacent dnsrequest pointer and heap data, causing memory corruption with confidentiality, integrity, and availability impact. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libeventto a version that resolves this vulnerability.Fixed in 2.1.13 - Upgrade
Upgrade
libeventto a version that resolves this vulnerability.Fixed in 2.2.2-alpha
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Affected deployments use Libevent before 2.1.13 or 2.2.2-alpha, are built as release builds with NDEBUG, and expose an AF_UNIX listener through the evhttp accept path. The vulnerable copy occurs when a kernel-supplied AF_UNIX peer address is stored in the smaller conn_address field.
What access does an attacker need?
An attacker does not need authentication, but must be a local peer able to connect to the affected AF_UNIX listener. The issue is locally exploitable, as reflected by the AV:L vector.
What is the impact of successful exploitation?
A connecting peer can cause a heap out-of-bounds write that overwrites the adjacent dns_request pointer and other heap data. This can result in confidentiality, integrity, and availability impact.
What versions contain the fix?
The issue is fixed in Libevent 2.1.13 and 2.2.2-alpha.