Description

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in bufferevent_sock.c when bufferevent_socket_set_conn_address_ copies a kernel-supplied AF_UNIX peer address into bufferevent_private.conn_address. Release builds compiled with NDEBUG disable the EVUTIL_ASSERT length guard, and the evhttp accept path can pass a 110-byte sockaddr from accept() into the 28-byte field. An unauthenticated local peer able to connect to an AF_UNIX listener can overwrite the adjacent dns_request pointer and heap data, causing memory corruption with confidentiality, integrity, and availability impact. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.4",
  "pubDate": "2026-08-20T18:16:36.893Z",
  "pubdate": "2026-08-20T18:16:36.893Z",
  "executiveSummary": "A heap out-of-bounds write vulnerability exists in the libevent event notification library prior to versions 2.1.13 and 2.2.2-alpha. The flaw resides in bufferevent_sock.c when handling kernel-supplied AF_UNIX peer addresses.\nThe vulnerability allows an unauthenticated local peer capable of connecting to an AF_UNIX listener to trigger memory corruption by overflowing the destination buffer.\nExploitation of this issue leads to severe impacts affecting confidentiality, integrity, and availability, as adjacent heap data and the dns_request pointer can be overwritten.\nRelease builds compiled with NDEBUG exacerbate the vulnerability by disabling the EVUTIL_ASSERT length guard that would otherwise prevent the oversized copy operation.\nMitigation requires updating libevent to version 2.1.13, 2.2.2-alpha, or later where the issue is formally addressed.",
  "technicalDetails": "The root cause of the vulnerability is an insufficient bounds check and buffer size mismatch during the execution of bufferevent_socket_set_conn_address_ within bufferevent_sock.c.\nThe vulnerable component is the socket buffering subsystem, specifically where the evhttp accept path processes incoming connections.\nDuring the accept path execution, the application can pass a 110-byte sockaddr structure obtained from accept() directly into a fixed 28-byte destination field designated as bufferevent_private.conn_address.\nIn release builds compiled with NDEBUG, defensive EVUTIL_ASSERT length guards are disabled, allowing the oversized kernel-supplied AF_UNIX peer address to be copied without truncation or failure, resulting in a heap out-of-bounds write.\nThe attack flow requires an unauthenticated local peer to establish a connection to an AF_UNIX listener managed by the affected libevent application.\nUpon connection acceptance, the kernel supplies the AF_UNIX peer address, which triggers the unsafe copy operation into the smaller 28-byte internal buffer.\nThe resulting heap corruption overwrites adjacent critical data structures, notably the dns_request pointer and surrounding heap metadata.\nPost-exploitation impact includes arbitrary memory corruption, potentially leading to remote code execution or application crashes, thereby compromising system integrity, availability, and confidentiality.\nThe vulnerability affects libevent versions prior to 2.1.13 and 2.2.2-alpha."
}