CVE-2026-88341: YARA YARA vulnerability
A reachable assertion vulnerability exists in YARA 4.5.8 when loading crafted .yrc compiled rule files. An attacker can provide a malicious file with an invalid arena configuration (numbuffers=0) that triggers an assertion failure in yrarenagetptr(), causing the application to terminate.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using YARA 4.5.8 that load compiled .yrc rule files are exposed if an attacker can supply or influence the contents of those files.
What does an attacker need to trigger the failure?
The attacker needs to provide a crafted compiled .yrc file with an invalid arena configuration where num_buffers is set to 0. Loading that file can trigger an assertion failure in yr_arena_get_ptr() and terminate the application.
What is the impact of successful exploitation?
Successful exploitation causes the affected application to terminate, resulting in a denial of service.