CVE-2026-63387 in Libevent
Summary
by MITRE • 08/20/2026
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdns_server_request_format_response. The final-label check permits j plus label_len plus one to equal buf_len, after which the terminating null byte is written to buf[buf_len]. A crafted DNS server response containing PTR, CNAME, MX, NS, or SOA data can trigger the one-byte out-of-bounds write and crash or corrupt the process. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
Libevent serves as a widely adopted asynchronous event notification library utilized by numerous high-performance network applications to manage I/O operations efficiently. Within this ecosystem, the DNS resolution subsystem relies on specific internal functions to parse and format domain name records received from remote servers. A critical vulnerability exists in the evdns.c module, specifically within the dnsname_to_labels function which is responsible for converting encoded DNS names into label-based formats during response processing. This flaw manifests as an off-by-one stack buffer overflow that occurs when handling specific types of resource records such as PTR, CNAME, MX, NS, or SOA data embedded in crafted DNS server responses. The vulnerability arises because the boundary check logic incorrectly permits a condition where the index variable j plus the label length plus one equals the total buffer size, thereby allowing subsequent code to write a terminating null byte at an offset equal to buf_len rather than within valid bounds.
The technical root cause lies in the memory management logic of evdns_server_request_format_response which allocates a fixed 64 KB stack buffer for constructing DNS responses. When processing incoming records, the function calculates offsets and lengths without strictly enforcing that there is sufficient space remaining for the null terminator after writing all label data. Consequently, if an attacker crafts a malicious DNS response with carefully constructed record fields, they can trigger this boundary condition. The resulting one-byte out-of-bounds write overwrites adjacent stack memory, which typically contains return addresses or other critical control flow information. This corruption leads to immediate process crashes due to segmentation faults or potentially allows for arbitrary code execution if the attacker can precisely predict and manipulate the overwritten data structure during exploitation attempts.
From a security impact perspective, this vulnerability poses significant risks including denial of service through application instability and potential remote code execution depending on the context in which libevent is deployed. Applications relying heavily on DNS resolution such as web servers, proxies, or custom network daemons are particularly susceptible if they process untrusted DNS responses directly without additional validation layers. The attack vector requires interaction with a malicious DNS server capable of sending specially formatted packets that exploit this parsing logic. This aligns with Common Weakness Enumeration category CWE-122 which describes heap-based buffer overflows, although in this specific instance the overflow occurs on the stack making it technically closer to CWE-121 or more accurately CWE-787 depending on precise memory layout analysis but generally categorized under improper boundary checks leading to out-of-bounds writes. In terms of adversarial tactics, this vulnerability relates to ATT&CK technique T1059 which covers command and script interpreter execution if code injection is successful, though primarily it facilitates initial compromise through exploitation of input validation failures in network-facing services.
Mitigation strategies involve upgrading libevent to version 2.1.13 or later where the boundary check logic has been corrected to ensure that null terminators are always written within allocated buffer limits regardless of label lengths. Organizations should also implement defense-in-depth measures such as DNS response size limiting and input validation at network perimeter devices to reduce exposure to crafted packets. Additionally, enabling stack canaries and address space layout randomization on systems running vulnerable versions provides supplementary protection against exploitation attempts by making it harder for attackers to reliably control execution flow after the buffer overflow occurs. Regular patch management cycles should prioritize updates to networking libraries given their central role in application security posture.