CVE-2026-102507

Sliver 1.7.7 Denial of Service via PE Parser Slice Bounds in Operator RPC

Published Sep 29, 2026 CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Description

Sliver C2 framework version 1.7.7 and earlier contains an unhandled panic vulnerability in the operator gRPC handler that allows an attacker controlling a compromised implant to crash the entire teamserver by returning a malformed or empty Download response. Attackers can send zero-length or 1-3 byte data payloads through a hostile implant session to trigger an out-of-bounds slice access in the vendored Binject library's BinaryMagic function, which propagates unrecovered through the operator gRPC interceptor chain and terminates the server process, affecting all connected operators.

Analysis

Technical impact

An unhandled panic occurs in the operator gRPC handler of Sliver C2 framework versions 1.7.7 and earlier. The vulnerability stems from an out‑of‑bounds slice access in the vendored Binject library’s BinaryMagic function when processing a malformed or empty Download response. This causes the server process to terminate, disrupting all connected operators, and is mapped to CWE‑125.

Affected Systems

BishopFox Sliver C2 framework version 1.7.7 and earlier

Risk and Exploitability

The vulnerability has a CVSS score of 6.8, is not currently in the CISA KEV catalog, and the EPSS score is not available. Attackers need control of a compromised implant to exploit the flaw by sending zero‑length or 1–3 byte payloads through a hostile implant session, which triggers the out‑of‑bounds access and crashes the server. The risk is moderate, as the DoS impact requires an existing implant compromise. If such a compromise occurs, all operators will be affected until the server is restarted or patched.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

BishopFox

sliver

unaffected

Version	Status	Constraints
`1.1.0`	affected	≤ 1.7.7

No data.

Vendor Product Versions

Bishopfox

Sliver

Version	Status	Scheme	Platform
`[1.1.0,1.7.7]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to the latest Sliver release that fixes the Binject plugin issue and removes the out‑of‑bounds error.
Restart the Sliver teamserver after applying the patch to recover from any crash state.
Restrict access to the vulnerable RPC endpoint or block malicious payloads by configuring firewall or limits until the patch is applied.

Generated by OpenCVE AI on September 30, 2026 at 03:06 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction Active

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.184% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/h00die/sliver_1.7.7_DoS
https://www.vulncheck.com/advisories/sliver-denial-of-service-via-pe-parser-slice-bounds-in-operator-rpc

History

Oct 1, 2026 3:30 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:bishopfox:sliver::::::::

Sep 29, 2026 7:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Bishopfox Bishopfox sliver
Vendors & Products		Bishopfox Bishopfox sliver

Sep 29, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 29, 2026 1:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Sliver C2 framework version 1.7.7 and earlier contains an unhandled panic vulnerability in the operator gRPC handler that allows an attacker controlling a compromised implant to crash the entire teamserver by returning a malformed or empty Download response. Attackers can send zero-length or 1-3 byte data payloads through a hostile implant session to trigger an out-of-bounds slice access in the vendored Binject library's BinaryMagic function, which propagates unrecovered through the operator gRPC interceptor chain and terminates the server process, affecting all connected operators.
Title		Sliver 1.7.7 Denial of Service via PE Parser Slice Bounds in Operator RPC
Weaknesses		CWE-125
References		https://github.com/h00die/sliver_1.7.7_DoS https://www.vulncheck.com/advisories/sliver-denial-of-service-via-pe-parser-slice-bounds-in-operator-rpc
Metrics		cvssV3_1 `{'score': 5.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H'}` cvssV4_0 `{'score': 6.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`