REDHAT-BUG-2520657: Use After Free

Q: What conditions are required to trigger this issue?

An attacker or other caller must be able to drive Libevent into a specific buffer state: evbuffer_add_buffer_reference must process an output buffer with out_total_len equal to zero. The subsequent multicast append operation can then dereference a dangling pointer.

Q: What is the likely impact if the vulnerable buffer state is reached?

The use-after-free can cause memory corruption or crash the affected process. The provided information does not establish whether code execution is possible.

Q: Which releases contain the fix?

The issue is fixed in Libevent 2.1.13 and 2.2.2-alpha. Versions prior to those releases are described as affected.

Published Aug 20, 2026

Updated

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbufferaddbufferreference processes an output buffer whose outtotallen is zero. evbufferfreeallchains frees the initial empty chain without resetting outbuf->first, outbuf->last, or outbuf->lastwithdatap, and APPENDCHAINMULTICAST subsequently dereferences the dangling chain pointer. A caller that can drive this buffer state can cause memory corruption or a process crash. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Affected Software

1 affected component

libevent libevent<2.1.13, <2.2.2-alpha

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade libevent to a version that resolves this vulnerability.
Fixed in 2.1.13
Upgrade
Upgrade libevent to a version that resolves this vulnerability.
Fixed in 2.2.2-alpha

Event History

Aug 20, 2026

Data Sourced

via Red Hat·06:05 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What conditions are required to trigger this issue?

An attacker or other caller must be able to drive Libevent into a specific buffer state: evbuffer_add_buffer_reference must process an output buffer with out_total_len equal to zero. The subsequent multicast append operation can then dereference a dangling pointer.

What is the likely impact if the vulnerable buffer state is reached?

The use-after-free can cause memory corruption or crash the affected process. The provided information does not establish whether code execution is possible.

Which releases contain the fix?

The issue is fixed in Libevent 2.1.13 and 2.2.2-alpha. Versions prior to those releases are described as affected.

REDHAT-BUG-2520657: Use After Free

Affected Software

Remediation

Event History

Frequently Asked Questions

What conditions are required to trigger this issue?

What is the likely impact if the vulnerable buffer state is reached?

Which releases contain the fix?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required to trigger this issue?

What is the likely impact if the vulnerable buffer state is reached?

Which releases contain the fix?