bincookie EUVD-2026-102203

Exploitation requires that a victim application built against bincookie prior to 0.1.9 be made to parse an attacker-supplied .binarycookies file via bincookie_init_file(); the malicious file sets a num_pages value larger than the real page-size table (or supplies page sizes / cookie_offsets exceeding the buffer) so the unbounded byte-swap and iteration loops run past the heap allocation. There is no network-facing service here - the attacker must deliver the crafted file and the application must invoke the parser on it (AV:L, UI:R), which are the main limiting factors; exploitation does not require authentication to the parsing application (PR:N). Upgrading to 0.1.9 fully mitigates, as malformed files are now rejected with NULL/EIO.

This is a genuine memory-safety flaw (CWE-122 heap-based buffer overflow) in bincookie's bincookie_init_file() parser, where the file-controlled num_pages, page_sizes, and cookie_offsets are trusted as loop bounds against a buffer sized only to the real file length, enabling out-of-bounds heap reads/writes. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.8 HIGH) is internally consistent and matches the description: exploitation is LOCAL (AV:L) because an attacker must get a crafted .binarycookies file to a victim application, and it requires user interaction (UI:R) in the sense that the application must be induced to parse the malicious file. No EPSS score was supplied in the input, and the CVE is NOT on CISA KEV; no public proof-of-concept is referenced (the only code artifact is the vendor patch commit, not an exploit). Signals therefore point to a real-but-not-urgent issue: the technical impact is high (potential code execution via heap corruption, hence the RCE tag) but there is no evidence of active or at-scale exploitation, and the local/file-delivery attack vector plus the product's obscurity sharply limit real-world reach. Note a CWE discrepancy to verify: the input labels this CWE-122 (heap overflow) while the vendor changelog cites CWE-787 (out-of-bounds write) - these are closely related and not conflicting in substance. Realistic prioritization: moderate - patch promptly in any software that embeds this header, but it is not a mass-exploitation emergency.

An attacker crafts a malicious .binarycookies file with an inflated num_pages (or bogus page sizes/cookie offsets) and delivers it to a victim who runs an application linking bincookie <0.1.9. When the application calls bincookie_init_file() to parse the file, the byte-swap and iteration loops read and write past the heap allocation, crashing the process or corrupting the heap in a way that may be steered toward code execution. No public exploit code is identified at time of analysis, and the attack requires the victim to open/parse the attacker-supplied file.