libconfini EUVD-2026-98804

Exploitation requires that the consuming software actually incorporates libconfini's bundled example utility load_ini_buffer (examples/utilities/load_ini_buffer.h) - this is NOT reachable through the core library API alone. The affected code path allocates malloc(ini_length) but strip_ini_cache() writes a NUL terminator at ini_source[ini_length], one byte beyond the buffer, so an attacker must supply an INI buffer that reaches the cache-stripping path with a length that triggers the off-by-one. LIMITING FACTORS: impact is availability-only (process crash, no code execution or data disclosure indicated); the vulnerable example code must be shipped and fed attacker-influenced input; reliability of converting a single-byte heap NUL overflow into a consistent crash is allocator- and layout-dependent. Affected release is v1.16.4.

Signals are mostly aligned toward a LOW-to-MODERATE real-world priority despite the 7.5 'High' CVSS. The NVD vector (AV:N/AC:L/PR:N/UI:N) technically describes unauthenticated remote exploitation, but the impact metrics are availability-only (C:N/I:N/A:H) - there is no confidentiality or integrity loss, and the root cause is a single off-by-one heap write (malloc(ini_length) vs. the ini_length+1 bytes strip_ini_cache() needs for its NUL terminator). EPSS is low (0.29%, 20th percentile), there is no CISA KEV listing, and no vendor-confirmed active exploitation, so this is a high-CVSS-but-low-real-risk issue rather than an urgent threat. A key caveat: the flaw lives in a BUNDLED EXAMPLE utility (examples/utilities/load_ini_buffer.h), NOT the core libconfini parsing API, so the AV:N 'remote' framing is optimistic - it only applies if a consuming application actually ships that example code AND feeds it attacker-controlled, specifically-sized INI data. For most deployments the practical reachability and the reliability of turning a 1-byte NUL overflow into a crash are both uncertain, so treat the network/unauthenticated characterization with caution and verify whether the example utility is actually in use.

An application that reuses libconfini's bundled load_ini_buffer example utility parses an INI buffer sourced from an untrusted input of a specific length; strip_ini_cache() then writes a NUL terminator one byte past the under-sized heap allocation, corrupting adjacent heap state and potentially crashing the process (denial of service). A reproducer/write-up appears to exist in the referenced GitHub gist, but no weaponized remote exploit is confirmed.