Lib0
Monthly
An out-of-bounds read in lib0's binary decoder before version 0.2.119 lets remote attackers who control serialized input cause the decoder to return bytes from outside the intended buffer view, exposing adjacent process memory that may contain credentials, tokens, or log data. The flaw is unauthenticated and remotely reachable (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 8.6) because any application that decodes attacker-supplied data with lib0 - directly or transitively through Yjs - can be driven into the over-read; the leaked bytes are opportunistic contents of the backing/pooled ArrayBuffer rather than attacker-selected addresses. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), and the impact is limited to confidentiality with no integrity or availability effect; the vendor has published a fix in lib0 0.2.119.
Unauthenticated remote peers can read adjacent process memory from any service that feeds attacker-supplied bytes into the lib0 binary decoder, because readUint8Array never validated the wire-supplied length against the decoder's remaining view before the fix. Affected deployments are those running lib0 0.2.1 through 0.2.117, or 1.0.0-rc.32 and earlier - most notably Yjs-based collaboration and sync services where a peer can supply bytes to the decoder, including before authentication. The leak only completes when the consuming application echoes, stores, or re-serves the decoded value back to the attacker, but under that condition multi-tenant or shared-process hosts can expose other tenants' document content and live bearer session tokens; no public exploit code was identified at time of analysis and there is no CISA KEV entry, though the root cause is trivially reachable by anyone able to open a socket.
An out-of-bounds read in lib0's binary decoder before version 0.2.119 lets remote attackers who control serialized input cause the decoder to return bytes from outside the intended buffer view, exposing adjacent process memory that may contain credentials, tokens, or log data. The flaw is unauthenticated and remotely reachable (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 8.6) because any application that decodes attacker-supplied data with lib0 - directly or transitively through Yjs - can be driven into the over-read; the leaked bytes are opportunistic contents of the backing/pooled ArrayBuffer rather than attacker-selected addresses. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), and the impact is limited to confidentiality with no integrity or availability effect; the vendor has published a fix in lib0 0.2.119.
Unauthenticated remote peers can read adjacent process memory from any service that feeds attacker-supplied bytes into the lib0 binary decoder, because readUint8Array never validated the wire-supplied length against the decoder's remaining view before the fix. Affected deployments are those running lib0 0.2.1 through 0.2.117, or 1.0.0-rc.32 and earlier - most notably Yjs-based collaboration and sync services where a peer can supply bytes to the decoder, including before authentication. The leak only completes when the consuming application echoes, stores, or re-serves the decoded value back to the attacker, but under that condition multi-tenant or shared-process hosts can expose other tenants' document content and live bearer session tokens; no public exploit code was identified at time of analysis and there is no CISA KEV entry, though the root cause is trivially reachable by anyone able to open a socket.