libstrophe CVE-2026-112063

The victim must run a libstrophe-based client (version through 0.14.0) that performs SCRAM SASL authentication and must initiate a connection to an attacker-controlled or compromised XMPP server; the server then sends a server-first-message whose s= (salt) attribute base64-decodes to more than 124 bytes, overflowing the 128-byte stack buffer in SCRAM_Hi(). Limiting factors: exploitation is passive and requires the client to connect to the malicious server (AT:P/UI:P) rather than any action against an exposed service; SCRAM-based authentication must be in use; and memory-overwrite (versus a controlled abort) only occurs in NDEBUG builds where the guarding assertion is compiled out, so default assert-enabled builds yield a crash/DoS rather than memory corruption.

This is a client-side vulnerability in which a malicious or compromised XMPP server attacks a connecting libstrophe client - not a server-side flaw exploitable at scale. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:H) scores 6.0 (Medium) and the signals are internally consistent: network vector but gated by an attack requirement (AT:P, victim must connect to an attacker-controlled server) and passive user interaction (UI:P), with impact dominated by availability (VA:H, client abort) and only low integrity (VI:L, stack corruption in NDEBUG builds) and zero confidentiality. No EPSS score was provided and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation; exploitation status is 'no public exploit identified at time of analysis,' though a detailed technical write-up exists on hackmd. The realistic worst case is denial of service (client crash/abort); reliable arbitrary code execution is uncertain and limited to NDEBUG builds where the guarding assertion is compiled out, and stack canaries/ASLR further constrain exploitability. Net: a genuine but lower-priority Medium issue - the attacker must control the server the victim chooses to authenticate to, so this favors targeted or malicious-service scenarios over widespread opportunistic attacks. Reported by VulnCheck but no independent vendor (strophe) patch advisory is referenced in the provided data - verify fix availability with the project.

A libstrophe-based XMPP client (e.g., a chat application) initiates SCRAM SASL authentication to a server the attacker controls or has compromised. The server returns a server-first-message whose s= (salt) attribute base64-decodes to more than 124 bytes, overflowing the 128-byte stack buffer in SCRAM_Hi() and crashing the client, or corrupting stack memory in NDEBUG builds. A technical write-up is publicly available, but no weaponized exploit code is identified; exploitation is passive, requiring the victim to connect to the malicious server.