libevent CVE-2026-63383

Exploitation requires that the target application specifically invokes libevent's event tagging / tagged RPC subsystem (the decode_tag_internal function in event_tagging.c) on data supplied or influenced by an attacker. Applications using libevent exclusively for socket multiplexing, timers, or HTTP without the tagging API are not affected. Additionally, the evbuffer must present the tag data in a fragmented (non-contiguous) layout so that the pullup window and the full logical length diverge; a contiguous single-extent evbuffer of 5 bytes or fewer would not trigger the boundary crossing. The CVSS vector (PR:N/UI:N/AV:N) confirms no authentication or user interaction is required once the vulnerable code path is reachable, and no non-default build configuration is specified. Exploitation is limited to denial-of-service (process crash); memory disclosure is theoretically possible from the OOB read region but not confirmed as a practical information-leak vector.

The CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) reflects a straightforward network-reachable denial-of-service with no complexity barriers and no authentication requirement, which is accurate for the class of exposure: any application exposing the libevent RPC tagging path to untrusted network input is directly vulnerable. Critically, the sole impact is process availability (VA:H); confidentiality and integrity are unaffected (VC:N/VI:N), which lowers the real-world blast radius compared with the raw score. The vulnerability is not listed in CISA KEV, and no public exploit code has been identified, making active mass exploitation unlikely at time of analysis. The practical risk is therefore gated on whether a given deployment actually invokes the event tagging decoder on attacker-controlled data - applications using libevent purely for socket I/O or timers are not exposed. The combination of a high CVSS score, widely embedded library, available fixed versions, and DoS-only impact places this in the 'patch promptly, not emergency-incident' tier absent evidence of active exploitation.

An attacker sends a crafted network message to a service that uses libevent's tagged RPC decoding - for example a custom protocol server built on libevent's evbuffer/RPC API - containing a 6-byte malformed tag split across two non-contiguous evbuffer extents. When decode_tag_internal calls evbuffer_pullup for 5 bytes and then iterates using the original full length, the loop advances one byte past the flattened window into unmapped or invalid memory, triggering an invalid memory read that crashes the process. No exploit code is publicly known, but the attack is mechanically simple to replicate from the vulnerability description and commit diff alone.