CVE-2026-55246 in bincookie
Summary
by MITRE • 10/15/2026
bincookie is a header-only binarycookies parser. Prior to 0.1.9, bincookie_init_file() in bincookie.h allocates a buffer using the actual .binarycookies file length but trusts the file-controlled num_pages field as the loop bound for byte-swapping page_sizes entries. A crafted file can make the loop read and write beyond the heap allocation, and related unvalidated page sizes and cookie_offsets can drive additional out-of-bounds accesses in page and cookie iteration. Applications that parse an attacker-supplied binarycookies file may crash or suffer heap corruption that can potentially enable code execution. This issue is fixed in version 0.1.9.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in the bincookie library, a header-only parser for Apple's .binarycookies format, represents a critical memory safety flaw rooted in improper input validation and boundary checking. Specifically, within versions prior to 0.1.9, the function bincookie_init_file() exhibits a classic buffer over-read and potential write condition. The core technical issue arises from a discrepancy between how memory is allocated and how it is subsequently accessed during parsing operations. When initializing the parser with a file input, the library allocates a heap buffer based on the actual length of the .binarycookies file provided by the user. However, when processing the internal structure of this binary format, the code relies directly on the num_pages field contained within the file itself to determine the number of iterations for byte-swapping page_sizes entries. This creates a dangerous scenario where an attacker can supply a maliciously crafted file that declares a significantly higher number of pages than what actually exists in the allocated buffer.
This mismatch between the trusted, unvalidated metadata and the actual memory allocation leads directly to out-of-bounds access vulnerabilities. As the parser iterates through the page_sizes array using the attacker-controlled num_pages value as the loop bound, it reads from and potentially writes beyond the boundaries of the heap-allocated buffer. Furthermore, the vulnerability extends beyond simple boundary violations; related fields such as page sizes and cookie offsets are also insufficiently validated before being used to index into data structures during subsequent iteration phases. These unvalidated values can drive additional out-of-bounds accesses when the library attempts to parse individual cookies or navigate through pages of data. The lack of rigorous bounds checking on these structural elements allows an attacker to manipulate memory access patterns arbitrarily, turning a simple parsing error into a potent exploitation vector for heap corruption.
The operational impact of this vulnerability is severe, affecting any application that integrates bincookie to process user-supplied .binarycookies files without implementing additional defensive measures. The immediate consequence of exploiting the out-of-bounds read and write conditions is typically program instability, manifesting as crashes or segmentation faults due to memory access violations. However, in more sophisticated exploitation scenarios involving heap corruption, the implications are far more critical. By carefully crafting input that triggers specific overwrites within the heap metadata or adjacent data structures, an attacker can potentially achieve arbitrary code execution on the target system. This transforms a denial-of-service issue into a full remote code execution risk, particularly if the application processes cookies from untrusted sources such as web browsers or network services without proper sandboxing or input sanitization layers.
From a classification perspective, this vulnerability aligns with CWE-120 Buffer Copy without Checking Size of Input Classic and CWE-787 Out-of-bounds Write, reflecting the fundamental failure to validate buffer boundaries against actual allocation sizes. The exploitation technique leverages memory corruption principles often associated with heap-based attacks, which may correlate with ATT&CK techniques related to execution via binary or library hijacking if successful code execution is achieved through this vector. To mitigate these risks, developers must upgrade immediately to version 0.1.9 of bincookie, where the issue has been resolved by implementing strict validation checks on all file-controlled fields before they are used for memory access decisions. Additionally, applications integrating this parser should adopt a defense-in-depth strategy by validating input lengths against declared metadata and employing static analysis tools or fuzzing techniques to detect similar parsing flaws in other components of their software supply chain.