EUVD-2026-86269
GHSA-hqrg-m4c7-p48x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSupply non-empty INI to vulnerable app
-
DeliveryBundled helper allocates exactly ini_length bytes
-
Exploitstrip_ini_cache() writes NUL at ini_source[ini_length]
-
ExecutionOne-byte heap out-of-bounds write
-
ImpactHeap corruption crashes process (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an application that uses libconfini 1.16.4's BUNDLED load_ini_buffer.h allocation pattern (allocating exactly ini_length bytes) and then calls strip_ini_cache(), which unconditionally writes a NUL terminator at ini_source[ini_length]. Given that pattern, ANY non-empty INI input deterministically triggers the one-byte heap out-of-bounds write. Limiting factors: applications that allocate ini_length+1 bytes (as the library's own guidance/core usage would) are NOT affected; the impact is a single-byte NUL overwrite (crash/DoS only, no code execution demonstrated); and network reachability (AV:N) depends on whether the host application actually accepts attacker-controlled INI remotely - many libconfini uses are local configuration parsing. |
| Impact | This is a low-priority availability issue with signals broadly aligned toward low real-world risk. The CVSS 3.1 vector (5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) reflects a pure availability impact with no confidentiality or integrity loss, and EPSS agrees at 0.15% (3rd percentile) - negligible predicted exploitation. There is no CISA KEV listing and no public exploit code, only a GitHub issue report (madmurphy/libconfini #20); no SSVC decision data was provided. The most important nuance the raw score hides: the flaw is a deterministic one-byte NUL overwrite in the BUNDLED load_ini_buffer.h helper, not in the core parser - it only fires in applications that copy that specific under-allocation pattern (exactly ini_length bytes), so callers who size their buffers with the extra terminator byte are unaffected. Data conflict to verify: CVSS marks AV:N/PR:N/UI:N, but libconfini typically parses local configuration files, which would imply AV:L and no network exposure unless the application ingests attacker-supplied INI over the network - verify against the actual application's input path. A single-byte NUL write is also hard to escalate beyond a crash, consistent with A:L only. |
| Exploit ScenarioDerived | An application built on libconfini 1.16.4 that reuses the bundled load_ini_buffer.h allocation pattern reads a non-empty INI document (e.g., an uploaded or user-supplied config); strip_ini_cache() writes a NUL one byte past the heap allocation, corrupting adjacent heap metadata and crashing the process. Exploitation is deterministic on any non-empty input but yields only denial of service; no public exploit code exists at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Heap out-of-bounds write in libconfini 1.16.4 causes deterministic denial of service in applications that follow the library's bundled load_ini_buffer.h allocation pattern, which sizes the INI buffer to exactly ini_length bytes while strip_ini_cache() unconditionally writes a NUL terminator at ini_source[ini_length]. Any non-empty INI input is sufficient to trigger the resulting single-byte heap corruption, so exploitation requires no special payload or timing. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, 5.3) frames the issue as unauthenticated and remotely reachable, but real-world network exposure depends entirely on whether the host application actually parses attacker-supplied INI content; no public exploit code was identified at time of analysis, there is no CISA KEV entry, and EPSS is only 0.15% (3rd percentile), supporting a low-priority availability assessment with no demonstrated code execution.
RemediationAI
No vendor-released patch was identified at time of analysis, so the immediate fix is to correct the allocation contract on the caller side: allocate ini_length+1 bytes (or otherwise ensure at least one writable byte beyond the parsed content) before invoking strip_ini_cache(), which eliminates the out-of-bounds NUL write with negligible memory overhead. If the buffer originates from a fixed, mmap'd, or otherwise non-extensible region, copy it into a heap allocation one byte larger rather than parsing in place, accepting the minor additional copy cost. Applications that cannot change the allocation path should avoid calling strip_ini_cache() on exactly sized buffers and instead use the library's own core buffering path, though this may drop the normalization behavior the function provides. Because the trigger is any non-empty INI input, input validation or size filtering is not an effective workaround; the practical hardening is to limit which callers can supply INI content and to keep remote/untrusted configuration uploads off endpoints that use the bundled helper. Track https://github.com/madmurphy/libconfini/issues/20 for an upstream fix and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-88370 for updated patch and version status, since no exact fixed release version is confirmed in the available data.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
libconfini is a small C library for parsing INI configuration files, and strip_ini_cache() is one of its formatting/normalization routines that rewrites a cached INI buffer in place, including terminating the resulting string with a NUL byte. The flaw is a classic off-by-one heap overflow (CWE-122): the bundled example/helper header load_ini_buffer.h allocates a heap buffer of exactly ini_length bytes for the raw INI data, but strip_ini_cache() assumes the contract that the caller has reserved one additional writable byte for the terminator and writes to ini_source[ini_length] unconditionally. Because the write is a single NUL byte placed one past the allocation, consequences are limited to heap metadata/adjacent-object corruption that manifests as a crash (availability impact only); no controlled data write or code execution primitive has been demonstrated. The root cause is a mismatch between the helper's allocation size and the function's documented/actual requirement, meaning applications that allocate ini_length+1 bytes - as the library's own core usage and guidance do - are not affected. The supplied CPE string cpe:2.3:a:n/a:n/a is a placeholder with no vendor or product precision, and EUVD likewise lists no structured version data, so product and version identification here rests on the description and the upstream GitHub issue (#20).
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Deterministic single-byte NUL overflow needs no privileges or interaction and yields crash-only impact (A:L); AV:N kept per NVD but is arguably AV:L since INI input is often local config.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
libconfini 1.16.4 contains a heap out-of-bounds write condition involving the bundled load_ini_buffer.h utility and strip_ini_cache(). The bundled utility allocates exactly ini_length bytes, while strip_ini_cache() unconditionally writes a NUL terminator at ini_source[ini_length], requiring an additional writable byte. Applications using the bundled allocation pattern can trigger deterministic heap memory corruption when processing any non-empty INI input, resulting in denial of service.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB