ModSecurity CVE-2026-52761

Exploitation requires that ModSecurity is deployed on an i386 (32-bit x86) architecture - the bug does not manifest on x86_64 or other architectures. Additionally, at least one active ModSecurity rule in the deployed rule set must use the t:utf8toUnicode transformation on the attacker-controlled input field being targeted; if no such rule is in use, there is no exploitable bypass condition. The attacker must know or discover that the target is running i386 ModSecurity to craft an effective evasion payload, though this may be inferred from server fingerprinting. No authentication is required - the attack is conducted over the network against normal HTTP traffic. Limiting factors: i386 is rare in contemporary production server deployments; most cloud and datacenter environments run x86_64 exclusively.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N, score 5.8) reflects the network accessibility and scope change (WAF bypass affecting downstream applications), but AC:L overstates ease of exploitation by ignoring the i386 architecture prerequisite - a condition not under attacker control. In practice, i386 production deployments are rare today, with the vast majority of servers running x86_64 or ARM; this architectural constraint substantially shrinks the real-world vulnerable population. No EPSS score was provided in the source data. The CVE is not listed in CISA KEV and no public exploit code has been confirmed. The CVSS Scope:Changed metric correctly signals that a successful bypass impacts the application behind the WAF, not just ModSecurity itself. Overall, this is a medium-priority issue: real severity if i386 deployment is confirmed, but the architectural specificity limits mass exploitability significantly compared to the raw CVSS score suggests.

An attacker targeting a web application protected by ModSecurity on an i386 server crafts an HTTP request containing a malicious payload (such as an XSS vector or SQL injection string) encoded in UTF-8 in a way specifically designed to evade detection after t:utf8toUnicode normalization. Because the transformation produces incorrect output on i386 due to the sizeof bug, the ModSecurity rule fails to match the normalized form of the payload, and the malicious request passes through the WAF to the backend application. No public proof-of-concept has been confirmed, but the deterministic nature of the bug makes exploitation straightforward once the architecture is confirmed.