aria2 EUVD-2026-66178

Exploitation requires that aria2 process an input file containing an empty line - such as a metalink descriptor, download list, or other file parsed by IOFile::getLine() - that causes the internal buffer length variable to be zero. The attack vector is local (AV:L): the attacker must be able to supply or influence a file that aria2 reads. No special privileges are required (PR:N per the CVSS vector) since any user who can invoke aria2 or provide it a crafted input can trigger the condition. Exploitation is constrained to crashing aria2 (Availability: Low); no code execution, data disclosure, or integrity violation has been identified. The vulnerability does not directly expose aria2's XML-RPC interface or network stack; the trigger is confined to the file-reading code path.

The CVSS 3.1 base score of 4.0 (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) correctly reflects a local, low-impact denial-of-service condition. The EPSS score of 0.15% at the 5th percentile strongly corroborates minimal attacker interest, and the absence of a CISA KEV listing or public exploit code leaves no actionable threat signal beyond the theoretical crash. The combination of local attack vector, availability-only impact, and very low EPSS places this in the lowest priority tier for patching. The only elevated concern arises in contexts where aria2 processes untrusted input files - such as metalink descriptors fetched from adversary-controlled servers - where an attacker could remotely influence the locally-processed file content. The EUVD lists affected versions as 'n/a', providing no additional version precision; affected version ceiling of 1.37.0 is sourced from the CVE description alone and has not been independently corroborated by a vendor advisory.

A local user or automated script supplies aria2 with a crafted input file - such as a metalink descriptor or download list - containing an empty line that causes IOFile::getLine() to receive a zero-length buffer result. The unchecked buf[len - 1] expression then accesses buf[-1], corrupting stack memory and crashing the aria2 process. Because no public proof-of-concept exploit exists and the impact is limited to process termination, exploitation beyond a targeted denial-of-service disruption is unlikely.