Libevent up to 2.1.12/2.2.2-alpha event_tagging.c decode_tag_internal out-of-bounds

Summaryinfo

A vulnerability was found in Libevent up to 2.1.12/2.2.2-alpha. It has been rated as critical. This affects the function decode_tag_internal of the file event_tagging.c. Performing a manipulation results in out-of-bounds. This vulnerability was named CVE-2026-63383. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability classified as critical has been found in Libevent up to 2.1.12/2.2.2-alpha. This affects the function decode_tag_internal of the file event_tagging.c. The manipulation with an unknown input leads to a out-of-bounds vulnerability. CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in event_tagging.c when decode_tag_internal requests at most five bytes from evbuffer_pullup but iterates using the full logical buffer length. A fragmented evbuffer containing a six-byte malformed tag can therefore advance past the pullup window and trigger an out-of-bounds read, which can crash a process that decodes attacker-controlled tagged RPC data. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-63383 since 07/16/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available.

Upgrading to version 2.1.13 or 2.2.2-alpha eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-63502). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• Libevent

Version

• 2.1.0
• 2.1.1
• 2.1.2
• 2.1.3
• 2.1.4
• 2.1.5
• 2.1.6
• 2.1.7
• 2.1.8
• 2.1.9
• 2.1.10
• 2.1.11
• 2.1.12
• 2.2.2-alpha

Website

• Product: https://github.com/libevent/libevent/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion