Sliver C2 EUVD-2026-88743

Requires the attacker to control an implant that has an active session with the Sliver teamserver (a hostile or compromised implant), and an operator must trigger a Download operation against that implant so the malformed response is parsed. Exploitation is thus gated by: prior establishment of an implant session (PR:L), operator interaction issuing a download (UI:A/required), and the teamserver running vulnerable Sliver 1.7.7 or earlier. It is not exploitable against a default fresh install with no connected malicious implant; the trigger is a zero-length or 1-3 byte Download response payload feeding the Binject BinaryMagic PE parser.

This is a genuine but bounded availability risk against a niche product. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A/VA:H, score 6.8) is availability-only - VC:N/VI:N confirm no confidentiality or integrity impact, so the 'Information Disclosure' tag is contradicted by the vendor's own vector. PR:L and the requirement that the attacker already control a compromised or hostile implant session substantially limit reach: this is not an internet-facing pre-auth flaw, but an abuse-of-trust condition where a subverted implant crashes the teamserver. A public POC exists (h00die/sliver_1.7.7_DoS) and the issue is VulnCheck-reported, but there is NO EPSS score and NO CISA KEV listing, so there is no evidence of active exploitation - POC availability and active exploitation are distinct signals. Notably, the threat model is inverted: the 'victim' is a red-team/adversary C2 operator, and the 'attacker' is typically the compromise target crashing the operator's teamserver. Net: real but low-to-medium priority - recoverable DoS, narrow trigger, niche footprint.

A defender (or malware analyst) who has identified a hostile Sliver implant on their network stands up a rogue/hostile implant session, or manipulates a compromised beacon, so that when a Sliver operator issues a Download command the implant returns a zero-length or 1-3 byte payload. This malformed response triggers an out-of-bounds slice read in the vendored Binject BinaryMagic() PE parser, panicking the teamserver and disconnecting all connected operators. Publicly available POC code (github.com/h00die/sliver_1.7.7_DoS) demonstrates the crash.