CVE-2026-75421 in aria2
Summary
by MITRE • 08/26/2026
aria2 <=1.37.0 has a stack-buffer-underflow vulnerability in the IOFile::getLine() function.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The aria2 download utility, specifically versions up to and including 1.37.0, contains a critical memory safety flaw within its file input handling logic. This vulnerability manifests as a stack-based buffer underflow located in the IOFile class method named getLine(). The function is responsible for reading lines of text from an open file descriptor or stream into a provided character buffer. In normal operation, this routine reads characters sequentially until it encounters a newline delimiter or reaches the end of the input data. However, due to improper boundary checks and index management within the implementation, the pointer arithmetic used to track the current position in the read buffer can decrement below its valid lower bound under specific conditions. This results in writing memory addresses that reside before the allocated stack frame for the function, leading to a corruption of adjacent stack variables or return addresses.
From a technical perspective, this flaw is classified as CWE-124, which denotes Buffer Underwrite. The root cause lies in the failure to validate whether the read operation has exhausted the available data before attempting to access memory locations preceding the start of the buffer. When processing certain malformed or specifically crafted input files, particularly those with unusual line endings or empty lines combined with specific offset parameters, the internal pointer logic may calculate an address that is lower than the base address of the stack-allocated array. This underflow allows for arbitrary write operations to memory locations outside the intended scope, which can overwrite critical control data such as saved frame pointers and return addresses stored on the call stack.
The operational impact of this vulnerability is severe, potentially leading to remote code execution if an attacker can force a victim user or service to process a maliciously crafted file through aria2. By carefully crafting input that triggers the underflow, an adversary could manipulate the program flow by overwriting the return address with shellcode pointers or gadgets from existing libraries (return-oriented programming). This would allow the execution of arbitrary commands on the host system with the privileges of the user running the aria2 process. Additionally, even if code execution is not achieved, the memory corruption can cause immediate application crashes, leading to a denial-of-service condition that disrupts download operations and potentially affects other services relying on stable file processing utilities within the same environment.
This vulnerability aligns with MITRE ATT&CK technique T1059, Command and Scripting Interpreter, as it provides an initial execution vector for attackers who can influence input data. It also relates to CWE-787, Out-of-bounds Write, specifically in a stack context. Mitigation strategies primarily involve upgrading aria2 to version 1.37.1 or later, where the IOFile::getLine() function has been patched with proper bounds checking and pointer validation logic. Until an upgrade is performed, administrators should restrict file input sources to trusted origins only and avoid processing untrusted files through this utility in production environments. Implementing strict input sanitization at higher-level application layers can also reduce the risk of exploitation by ensuring that malformed data does not reach the vulnerable component.