Libevent CVE-2026-63384

Exploitation requires that the target application uses libevent's evtag (event tagging/marshaling) API to process data received from an attacker-controlled source, such as a network peer or external input stream. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no special configuration are required beyond the application accepting tagged event data over the network. Exploitation is limited to applications that actually invoke evtag_unmarshal_header or evtag_unmarshal_string on untrusted input - applications that use libevent solely for its event loop or buffered I/O without invoking the evtag API are not vulnerable in practice. The attacker must be able to supply a raw tagged-data message with a crafted length field; no session hijacking or prior foothold is required if the evtag endpoint is exposed.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) accurately reflects the attack surface: no authentication, no special attack conditions, and a direct availability impact reachable over the network. This is not a case of CVSS inflation - the unauthenticated network vector is credible because evtag data is processed from externally-supplied buffers in any application that accepts tagged event streams from untrusted sources. The impact is confined to availability (DoS), with no confidentiality or integrity compromise, limiting the damage ceiling compared to a full RCE. No EPSS score was provided in the input, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at the time of analysis. The public GitHub advisory and fix commits make the root cause trivially understandable, which modestly increases the risk of opportunistic PoC development. Overall, real-world priority is moderate-to-high for any application that processes network-supplied libevent tagged data; applications that only use libevent for local event dispatch and never expose the evtag API to untrusted input have significantly lower effective risk.

An attacker with network access to a service that accepts libevent-tagged event data sends a crafted message with a payload length field set to a value exceeding INT_MAX (e.g., 0x80000000). Libevent's evtag_unmarshal_header decodes this as a large unsigned integer, which is implicitly cast to a negative signed int, and evtag_unmarshal_string then passes this negative length into an allocator call, producing an enormous or invalid allocation that crashes the process. No public exploit code has been identified, but the patch diff fully discloses the vulnerable code path, making reproduction straightforward.