Skip to main content

libevent CVE-2026-63381

| EUVDEUVD-2026-63504 MEDIUM
Use of Uninitialized Resource (CWE-908)
2026-08-20 GitHub_M
Buffer Overflow Libevent
5.8
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
5.8 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.6 MEDIUM

Local vector since exploitation requires driving application-level buffer API; PR:L for process-level access; A:H for reliable process crash on trigger.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
6.6 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Red Hat
6.6 MEDIUM
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
Source Code Evidence Fetched
Aug 20, 2026 - 18:38 vuln.today
Analysis Generated
Aug 20, 2026 - 18:38 vuln.today
Patch available
Aug 20, 2026 - 18:03 EUVD
CVE Published
Aug 20, 2026 - 17:50 cve.org
MEDIUM 5.8

DescriptionCVE.org

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbuffer_add_buffer_reference processes an output buffer whose out_total_len is zero. evbuffer_free_all_chains frees the initial empty chain without resetting outbuf->first, outbuf->last, or outbuf->last_with_datap, and APPEND_CHAIN_MULTICAST subsequently dereferences the dangling chain pointer. A caller that can drive this buffer state can cause memory corruption or a process crash. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

AnalysisAI

Use-after-free memory corruption in libevent's evbuffer_add_buffer_reference (buffer.c) allows a caller that can drive a specific empty-buffer state to trigger process crashes or heap corruption in any application linking the library. Affected are libevent stable releases before 2.1.13 and development releases 2.2.0-alpha through 2.2.2-alpha; the root cause is that evbuffer_free_all_chains frees the initial empty chain without nullifying the three outbuf chain-tracking pointers, after which APPEND_CHAIN_MULTICAST dereferences the now-dangling pointer. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the calling application to pass an output evbuffer whose internal chain was already freed (out_total_len == 0, with an existing empty chain established by a prior call such as evbuffer_add_reference with a zero-length buffer) into evbuffer_add_buffer_reference. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 5.8 with vector AV:L/AC:L/AT:P/PR:L correctly reflects a local, low-privilege vulnerability that requires a specific attack target condition (AT:P) - the caller must construct an output evbuffer with a zero-length chain before invoking evbuffer_add_buffer_reference. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade to libevent 2.1.13-stable (https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable) or libevent 2.2.2-alpha (https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha); both are confirmed vendor-released patches. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Libevent

View all
CVE-2016-10195 CRITICAL POC
9.8 Mar 15

The name_parse function in evdns.c in libevent before 2.1.6-beta allows remote attackers to have unspecified impact via

CVE-2016-10197 HIGH POC
7.5 Mar 15

The search_make_new function in evdns.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (out
CVE-2016-10196 HIGH POC
7.5 Mar 15

Stack-based buffer overflow in the evutil_parse_sockaddr_port function in evutil.c in libevent before 2.1.6-beta allows

CVE-2026-63382 CRITICAL
9.2 Aug 20

HTTP request smuggling in the libevent evhttp server (http.c) affects all versions prior to 2.1.13 and the 2.2.x-alpha l
CVE-2026-63384 HIGH
8.7 Aug 20

Integer overflow in Libevent's event tagging subsystem exposes any application using the evtag API to remote denial of s
CVE-2026-63383 HIGH
8.7 Aug 20

Out-of-bounds read in libevent's tagged RPC decoder crashes any application that decodes attacker-controlled tag data us
CVE-2026-63388 HIGH
8.4 Aug 20

Heap out-of-bounds write in libevent's bufferevent_sock.c allows any local peer connecting to an AF_UNIX evhttp listener
CVE-2014-6272 HIGH
7.5 Aug 24

Multiple integer overflows in the evbuffer API in Libevent 1.4.x before 1.4.15, 2.0.x before 2.0.22, and 2.1.x before 2.
CVE-2015-6525 HIGH
7.5 Aug 24

Multiple integer overflows in the evbuffer API in Libevent 2.0.x before 2.0.22 and 2.1.x before 2.1.5-beta allow context
CVE-2026-63495 HIGH
7.5 Aug 20

Memory exhaustion in libevent's WebSocket server (ws.c) allows unauthenticated remote clients to crash affected processe
CVE-2026-63387 HIGH
7.0 Aug 20

Off-by-one stack buffer overflow in Libevent's evdns component (versions prior to 2.1.13-stable and 2.2.2-alpha) enables
CVE-2026-63380 MEDIUM
5.7 Aug 20

Use-after-free in libevent's WebSocket session initialization (ws.c) before version 2.2.2-alpha allows a local low-privi

Same weakness CWE-908 – Use of Uninitialized Resource

View all
CVE-2011-1255 CRITICAL POC
9.3
CVE-2024-50302 MEDIUM
5.5
CVE-2024-12085 HIGH POC
7.5
CVE-2021-1104 CRITICAL POC
9.8
CVE-2021-29937 CRITICAL POC
9.8
CVE-2021-29936 CRITICAL POC
9.8
CVE-2021-26305 CRITICAL POC
9.8
CVE-2019-9641 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected

Share

CVE-2026-63381 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy