bincookie is a header‑only parser for .binarycookies files. In versions prior to 0.1.9 the function bincookie_init_file allocates a buffer sized to the file length but then trusts the file‑controlled num_pages field as the bound for a loop that byte‑swaps page size entries. A crafted file can cause this loop to read and write beyond the allocated heap buffer, resulting in a heap overflow. The overflow can corrupt adjacent heap data and, because unvalidated page_sizes and cookie_offsets drive later iterations, can lead to additional out‑of‑bounds accesses. The vulnerability is identified as CWE‑122 and CWE‑787 and can crash an application or, if exploited correctly, enable arbitrary code execution.

The vulnerability affects the Tatsh bincookie library in any application that parses .binarycookies files using bincookie before version 0.1.9. The security advisory and release notes indicate that updating to bincookie v0.1.9 or newer incorporates the fix that removes the unsafe use of num_pages as a loop bound.

The CVSS score of 7.8 reflects a high impact severity, and the EPSS score is reported as less than 1 percent, indicating that known exploitation attempts are very rare at present. The vulnerability is not listed in the CISA KEV catalog. Attackers must supply a malicious .binarycookies file to a parsing application; thus the attack vector is local file injection or supply. Because the flaw resides in application code rather than a network service, exploitation is limited to scenarios where the attacker can place a crafted file where the application will read it.