CVE-2026-88340: YARA YARA vulnerability
An invalid pointer release vulnerability exists in YARA 4.5.8 during deserialization of compiled .yrc rule files. The vulnerability is caused by insufficient validation of external-variable pointers, which may lead to invalid free in yrrulesdestroy() or wild pointer access in yrobjectcreate(). An attacker can provide a specially crafted .yrc file that causes memory corruption and application crash.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using YARA 4.5.8 that deserialize compiled .yrc rule files are exposed, particularly where those files can originate from an untrusted source.
What does an attacker need to exploit it?
An attacker needs to provide a specially crafted compiled .yrc rule file for the affected YARA instance to deserialize. The described outcomes are memory corruption and an application crash.
How can I determine whether my deployment is affected?
Check whether the application uses YARA 4.5.8 and loads or deserializes compiled .yrc rule files. The issue is relevant when such files may be attacker-controlled or insufficiently trusted.