CVE-2026-102360 in lib0
Summary
by MITRE • 09/29/2026
A missing bounds check in the binary decoder in lib0, versions 0.2.1-0.2.117 and earlier and 1.0.0-rc.32 and earlier, lets any unauthenticated remote peer read adjacent process memory and receive it back. `readUint8Array` never compares the wire-supplied length against the decoder's own view, so one over-long length prefix returns whatever the host process allocated next: other tenants' document content, personal data, and live bearer session tokens**, recovered in full and at will. An attacker who can supply bytes to a lib0 decoder which means any peer that can open a socket, including before authentication reads adjacent process memory and, where the consumer echoes, stores or re-serves the decoded value, receives it back. This is patched in version 0.2.118 and 1.0.0-rc.33.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified as a missing bounds check within the binary decoder of lib0 represents a critical security flaw affecting versions ranging from 0.2.1 through 0.2.117, as well as release candidates up to 1.0.0-rc.32. This issue stems directly from an improper validation mechanism in the readUint8Array function, which fails to compare the length value supplied by a remote peer against the actual available data within the decoder's internal buffer state. In secure software design, any external input that dictates memory allocation or reading boundaries must be rigorously validated against known limits to prevent out-of-bounds access. The absence of this check allows an attacker to specify a byte count that exceeds the current valid payload size, effectively instructing the application to read beyond the intended data segment into adjacent memory regions allocated by the host process.
From a technical perspective, this flaw constitutes an Out-of-Bounds Read vulnerability, aligning with CWE-125 in the Common Weakness Enumeration taxonomy. The operational impact is severe because it enables unauthenticated remote peers to perform arbitrary memory reads. Since lib0 is often used in collaborative editing and real-time data synchronization contexts, the application typically maintains sensitive state information, including document content from multiple tenants, personal user data, and active authentication tokens such as bearer session credentials. When an attacker supplies a crafted length prefix that triggers this out-of-bounds read, the host process returns whatever memory contents reside immediately after the intended buffer in its heap or stack allocation. This can include private data belonging to other users or system secrets, which are then transmitted back to the attacker over the network connection.
The attack vector is particularly dangerous because it requires no prior authentication. An adversary merely needs to establish a socket connection and send specifically crafted binary frames that exploit this decoding logic. If the consuming application echoes, stores, or re-serves the decoded value as part of its normal operational flow, the leaked memory contents are immediately exposed. This scenario falls under the MITRE ATT&CK technique for Data from Local System Memory Access, where an attacker leverages a vulnerability to exfiltrate sensitive information directly from the process address space without needing elevated privileges or complex exploitation chains involving code execution. The simplicity of this attack makes it highly feasible for automated scanning tools and opportunistic attackers targeting shared infrastructure environments.
To mitigate this risk, organizations must immediately upgrade lib0 to version 0.2.118 or later, which includes the necessary bounds checking logic in the binary decoder. For systems that cannot be updated instantly, implementing a network-level filter to inspect incoming WebSocket frames for anomalous length prefixes may provide temporary relief, though this is not a substitute for fixing the root cause at the application layer. Developers should also conduct code reviews focusing on all instances where external input determines buffer sizes or read lengths to ensure consistent adherence to safe memory access patterns. Regular dependency audits and automated static analysis tools configured to detect CWE-125 violations can help prevent similar issues in future development cycles, ensuring that data integrity and confidentiality are maintained against untrusted remote inputs.