CVE-2026-88370: Libconfini libconfini vulnerability
libconfini 1.16.4 contains a heap out-of-bounds write condition involving the bundled loadinibuffer.h utility and stripinicache(). The bundled utility allocates exactly inilength bytes, while stripinicache() unconditionally writes a NUL terminator at inisource[inilength], requiring an additional writable byte. Applications using the bundled allocation pattern can trigger deterministic heap memory corruption when processing any non-empty INI input, resulting in denial of service.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using libconfini 1.16.4's bundled load_ini_buffer.h utility with its bundled allocation pattern are exposed. The issue occurs when that utility allocates exactly ini_length bytes and the buffer is passed to strip_ini_cache().
What input is needed to trigger the memory corruption?
Any non-empty INI input can trigger the condition. strip_ini_cache() writes a NUL byte at index ini_length, which is one byte beyond the allocation made by the bundled utility.
What is the expected impact?
The described outcome is deterministic heap memory corruption that can result in denial of service.
What can be changed if the affected allocation pattern cannot immediately be removed?
Ensure the INI buffer has at least one additional writable byte beyond ini_length before strip_ini_cache() is called, so the terminating NUL write is within the allocation.