EUVD-2026-84850
GHSA-q333-36q9-7h8m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft .yrc with num_buffers=0 header
-
DeliveryDeliver malicious rules file to victim
-
ExploitVictim loads file via yr_rules_load
-
ExecutionAssertion fails in yr_arena_get_ptr()
-
ImpactProcess terminates (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V16 - Security Logging and Error Handling Reachable assertion handling
|
| Exploitation Conditions | Exploitation requires the victim application or user to load an attacker-supplied compiled YARA rules file (.yrc) whose arena header sets num_buffers=0; parsing it in yr_rules_load / yr_arena_load_stream drives yr_arena_get_ptr() into an assertion abort. Limiting factors: the attack is local (AV:L) and requires user interaction (UI:R) - the target must be induced to load untrusted compiled rules, which is not the default trust model since rules are usually authored locally. Impact is confined to a process crash (A:H, no C/I); there is no privilege escalation or code execution, and no authentication is bypassed. Environments most at risk are automated pipelines/services that ingest and load .yrc files from untrusted or third-party sources. |
| Impact | This is a genuine but low-priority issue: a reachable assertion (CWE-617) that only causes a denial of service. All signals agree on modest risk. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5 MEDIUM) is local, requires user interaction, and yields availability-only impact with no confidentiality or integrity loss - consistent with a crash-on-load bug. EPSS is very low (0.20%, 10th percentile) and it is NOT in CISA KEV, so no active exploitation is indicated. SSVC aligns: Exploitation=poc (a reproducer/test case exists, matching the commit's added test cases), Automatable=no, Technical Impact=partial - meaning this warrants routine patching, not emergency response. The only mild tension is that the SSVC 'poc' status and the vendor test harness confirm a working trigger exists, but this remains a crash rather than a code-execution primitive. Bottom line: real, verifiable, and cheaply fixed, but a high-CVSS-scare it is not - it is a bounded availability bug gated behind loading an untrusted file. |
| Exploit ScenarioDerived | An attacker crafts a malicious .yrc compiled-rules file with num_buffers=0 in its arena header and delivers it to a victim who loads it into a YARA-based scanner or automation pipeline. When yr_rules_load parses the file, yr_arena_get_ptr() hits an assertion failure and the process terminates. A reproducer/test case is effectively public (the fix commit adds test-api.c/test-arena.c cases that construct the exact malformed header), so exploitation is trivial to reproduce, though it yields only a crash. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Loading a crafted .yrc compiled rules file crashes YARA 4.5.8 (libyara) by driving an internal assertion to abort, giving an attacker a denial-of-service primitive against any process that parses untrusted compiled rules. The malicious file declares num_buffers=0 in its arena header, which reaches yr_arena_get_ptr() in libyara/arena.c and trips a failed assertion, terminating the host application. Exploitation is local with user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, score 5.5) and publicly available exploit code exists per the SSVC assessment (Exploitation: poc), though no confirmed active exploitation in CISA KEV has been reported and EPSS is low at 0.20% (10th percentile). Impact is limited to availability (process crash) with no confidentiality or integrity loss and no privilege escalation.
RemediationAI
Patch status: upstream fix available (PR/commit) at https://github.com/NOUIY/yara/commit/0cdff36723cd260243bb2b330bda555693354760 (hosted in a fork rather than the canonical VirusTotal repository), and a released patched YARA version is not independently confirmed in the supplied data - track https://github.com/VirusTotal/yara/issues/2238 and the NVD record https://nvd.nist.gov/vuln/detail/CVE-2026-88341 for the official release, then upgrade libyara to the first tagged version containing the arena.c and rules.c guards (num_buffers == 0 rejection plus the buffer_id >= num_buffers bounds check). Until a tagged release is available, the most effective compensating control is to stop loading .yrc files from untrusted sources: prefer source .yar rules compiled in-process (or, if .yrc exchange is unavoidable, verify a signature or checksum against a trusted publisher before calling yr_rules_load, and reject files whose header byte for num_buffers is 0), accepting the trade-off that this breaks workflows built around sharing precompiled rule sets. Run rule-compiling or rule-loading operations in an isolated, low-privilege worker that is monitored and automatically restarted, so an assertion abort degrades only that worker rather than the primary scanning service - this does not prevent the crash but contains its blast radius. Do not rely on removing assertions at build time as a fix: suppressing the abort can leave the same out-of-bounds buffer index unchecked, so it is at best a temporary stopgap. Given EPSS of 0.20% (10th percentile), no KEV listing, and SSVC marking Automatable as 'no' with technical impact 'partial', remediation can be scheduled on a routine cadence, with priority given to any internet-facing or automated .yrc ingestion path.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
YARA compiles rules into an .yrc binary format built on a set of memory 'arenas' managed by libyara/arena.c. Each arena file begins with a header containing a magic value, a format version, and a num_buffers field, and internal accessors such as yr_arena_get_ptr() index into the arena's buffer array. The bug is a reachable assertion (CWE-617): the loader only rejected headers where num_buffers exceeded YR_MAX_ARENA_BUFFERS, so a value of zero slipped through and produced an out-of-range buffer_id check (buffer_id > arena->num_buffers) that fails when no buffers exist, aborting the process. The upstream fix tightens that comparison to buffer_id >= arena->num_buffers, rejects num_buffers == 0 or values above YR_MAX_ARENA_BUFFERS in yr_arena_create() and yr_arena_load_stream() (returning ERROR_INVALID_ARGUMENT / ERROR_CORRUPT_FILE), and adds a guard in yr_rules_scan_proc() requiring at least YR_NUM_SECTIONS buffers. The accompanying test additions in tests/test-api.c and tests/test-arena.c construct .yarc files with num_buffers of 0 and 1 to confirm they now return ERROR_CORRUPT_FILE instead of aborting.
Know when Yara gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Loading an attacker-supplied .yrc file is local (AV:L) and needs the victim to open it (UI:R); the assertion abort kills the process (A:H) with no confidentiality/integrity impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
A reachable assertion vulnerability exists in YARA 4.5.8 when loading crafted .yrc compiled rule files. An attacker can provide a malicious file with an invalid arena configuration (num_buffers=0) that triggers an assertion failure in yr_arena_get_ptr(), causing the application to terminate.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
An integer overflow and several buffer overflow reads in libyara/modules/macho/macho.c in YARA v4.0.3 and earlier could
Buffer Overflow vulnerability in VirusTotal yara v.4.3.2 allows a remote attacker to execute arbtirary code via the yr_e
In the macho_parse_file functionality in macho/macho.c of YARA 3.11.0, command_size may be inconsistent with the real si
In YARA 3.7.1 and prior, parsing a specially crafted compiled rule file can cause an out of bounds write vulnerability i
In YARA 3.7.1 and prior, parsing a specially crafted compiled rule file can cause an out of bounds read vulnerability in
libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and
libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application cra
libyara/lexer.l in YARA 3.5.0 allows remote attackers to cause a denial of service (NULL pointer dereference and applica
libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application cra
The yr_arena_write_data function in YARA 3.6.1 allows remote attackers to cause a denial of service (buffer over-read an
An exploitable denial of service vulnerability exists in the object lookup functionality of Yara 3.8.1. Rated medium sev
In YARA 3.8.1, bytecode in a specially crafted compiled rule is exposed to information about its environment, in libyara
Exploit-DB