Libevent prior 2.1.13/2.2.2-alpha AF_UNIX Address bufferevent_sock.c bufferevent_socket_set_conn_address_ out-of-bounds write

Summaryinfo

A vulnerability identified as problematic has been detected in Libevent. This issue affects the function bufferevent_socket_set_conn_address_ of the file bufferevent_sock.c of the component AF_UNIX Address Handler. The manipulation leads to out-of-bounds write. This vulnerability is referenced as CVE-2026-63388. The attack can only be performed from a local environment. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Libevent. This issue affects the function bufferevent_socket_set_conn_address_ of the file bufferevent_sock.c of the component AF_UNIX Address Handler. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. Using CWE to declare the problem leads to CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in bufferevent_sock.c when bufferevent_socket_set_conn_address_ copies a kernel-supplied AF_UNIX peer address into bufferevent_private.conn_address. Release builds compiled with NDEBUG disable the EVUTIL_ASSERT length guard, and the evhttp accept path can pass a 110-byte sockaddr from accept() into the 28-byte field. An unauthenticated local peer able to connect to an AF_UNIX listener can overwrite the adjacent dns_request pointer and heap data, causing memory corruption with confidentiality, integrity, and availability impact. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-63388 since 07/16/2026. The exploitation is known to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 342219 (TencentOS Server 4: libevent (TSSA-2026:0884)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2.1.13 or 2.2.2-alpha eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (342219). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• Libevent

Website

• Product: https://github.com/libevent/libevent/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion