EUVD-2026-84849
GHSA-f27p-cq5g-fr5x
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Delivered as a malicious file a user must load (AV:N/UI:R, PR:N); described outcome is memory corruption and crash, so A:H with no substantiated confidentiality/integrity impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
5DescriptionCVE.org
An invalid pointer release vulnerability exists in YARA 4.5.8 during deserialization of compiled .yrc rule files. The vulnerability is caused by insufficient validation of external-variable pointers, which may lead to invalid free in yr_rules_destroy() or wild pointer access in yr_object_create(). An attacker can provide a specially crafted .yrc file that causes memory corruption and application crash.
AnalysisAI
Denial of service in YARA 4.5.8 occurs when libyara deserializes a crafted compiled rule file (.yrc): malformed external-variable pointers or an out-of-range type field are not validated in the yr_rules_load/yr_rules_from_arena path, resulting in an invalid free in yr_rules_destroy() or a wild pointer dereference in yr_object_create(). Only deployments that load compiled rules from untrusted or third-party sources are exposed, since the assessed vector requires a user or process to actively load the file (UI:R) and no authentication (PR:N); the realistic outcome is a process crash rather than code execution (C:N/I:N/A:H). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the target application or product to load an attacker-supplied compiled YARA rules file (.yrc) and deserialize it via YARA 4.5.8's yr_rules_load/yr_rules_from_arena path; the crafted file supplies malformed external-variable pointers or an out-of-range type field that pre-patch code fails to validate. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals point to a moderate, DoS-oriented issue rather than a top-tier priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: none confirmed - the available fix is the upstream change in VirusTotal/yara PR 2244 (commit 8d7bef643ee5fa2381e235bcedf80170a6b00d3b), which adds external-variable validation to yr_rules_from_arena(); treat this as 'Upstream fix available (PR/commit); released patched version not independently confirmed' and apply the commit or upgrade to the first tagged release that contains it, tracking issue 2239 and PR 2244 for confirmation (also see EUVD-2026-84849 and https://nvd.nist.gov/vuln/detail/CVE-2026-88340). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm whether any YARA 4.5.8 or libyara-based services in your environment accept .yrc compiled rule files from external or third-party sources; if so, immediately block such uploads and restrict rule ingestion to a trusted internal build pipeline. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-763 – Release of Invalid Pointer or Reference
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today