DEBIAN-CVE-2026-126050: Buffer Overflow
apitrace 2.0 through 14.0 contains a heap-based buffer overflow in SnappyFile::flushReadCache() that allows attackers to write past mcompressedCache via an oversized compressed chunk length. Attackers can supply a crafted .trace file whose 4-byte chunk length exceeds the fixed buffer size, corrupting heap memory when users dump, inspect, or replay it.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of apitrace 2.0 through 14.0 are exposed when they dump, inspect, or replay an attacker-supplied .trace file. The vulnerable component is the trace-file processing path.
What does an attacker need to exploit it?
An attacker needs to provide a crafted .trace file containing an oversized compressed chunk length. User interaction is required because a user must process that file with apitrace.
Are default installations affected?
The issue affects the specified apitrace versions when they process a malicious trace file; the provided data does not identify any configuration change required for exposure.
How can I determine whether I may already be affected?
Check whether the system has apitrace version 2.0 through 14.0 and whether it has dumped, inspected, or replayed untrusted .trace files. The described condition is an oversized 4-byte compressed chunk length that causes heap-memory corruption during processing.