Libevent up to 2.1.12/2.2.1 Buffer buffer.c evbuffer_add_buffer_reference out_total_len use after free

Summaryinfo

A vulnerability was found in Libevent up to 2.1.12/2.2.1. It has been declared as critical. Affected by this issue is the function evbuffer_add_buffer_reference of the file buffer.c of the component Buffer. Such manipulation of the argument out_total_len leads to use after free. This vulnerability is uniquely identified as CVE-2026-63381. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Libevent up to 2.1.12/2.2.1. It has been rated as critical. Affected by this issue is the function evbuffer_add_buffer_reference of the file buffer.c of the component Buffer. The manipulation of the argument out_total_len with an unknown input leads to a use after free vulnerability. Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbuffer_add_buffer_reference processes an output buffer whose out_total_len is zero. evbuffer_free_all_chains frees the initial empty chain without resetting outbuf->first, outbuf->last, or outbuf->last_with_datap, and APPEND_CHAIN_MULTICAST subsequently dereferences the dangling chain pointer. A caller that can drive this buffer state can cause memory corruption or a process crash. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-63381 since 07/16/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

Upgrading to version 2.1.13 or 2.2.2-alpha eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Libevent

Version

• 2.1.0
• 2.1.1
• 2.1.2
• 2.1.3
• 2.1.4
• 2.1.5
• 2.1.6
• 2.1.7
• 2.1.8
• 2.1.9
• 2.1.10
• 2.1.11
• 2.1.12
• 2.2.0
• 2.2.1

Website

• Product: https://github.com/libevent/libevent/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion