CVE-2026-63381

Libevent: Dangling Pointer in `evbuffer_add_buffer_reference`

Published Aug 20, 2026 CVSS 4.0 · 5.8 Medium EPSS < 1% KEV · Not listed

Description

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbuffer_add_buffer_reference processes an output buffer whose out_total_len is zero. evbuffer_free_all_chains frees the initial empty chain without resetting outbuf->first, outbuf->last, or outbuf->last_with_datap, and APPEND_CHAIN_MULTICAST subsequently dereferences the dangling chain pointer. A caller that can drive this buffer state can cause memory corruption or a process crash. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Analysis

Technical impact

A use‑after‑free occurs in libevent’s evbuffer_add_buffer_reference when handling an output buffer whose out_total_len is zero. The function frees an empty chain without resetting linked‑list pointers, and a subsequent APPEND_CHAIN_MULTICAST dereferences the stale pointer. The defect is classified as CWE‑908 and can lead to memory corruption or a process crash.

Affected Systems

The affected products are libevent library releases prior to 2.1.13 and 2.2.2‑alpha. Versions before these releases contain the flaw; the issue is fixed in 2.1.13 and the unstable 2.2.2‑alpha release. Applications linked against the vulnerable library are at risk.

Risk and Exploitability

The CVSS score of 5.8 indicates moderate severity. The EPSS score is below 1%, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to influence the creation of a zero‑length output buffer—an input that can be controlled within applications using libevent—to trigger the use‑after‑free. The impact is local.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

libevent

affected

Version	Status	Constraints
`>= 2.2.0-alpha, < 2.2.2-alpha`	affected	—
`< 2.1.13`	affected	—

No data.

Vendor Product Versions

Libevent Project

Libevent

Version	Status	Scheme	Platform
`[2.2.0-alpha,2.2.2-alpha)`	affected	semver	—
`[0,2.1.13)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade libevent to version 2.1.13 or newer, which removes the dangling‑pointer bug.
If an upgrade cannot be performed immediately, audit code paths that create output buffers and ensure that out_total_len never equals zero before calling evbuffer_add_buffer_reference; add defensive checks or sanitization to enforce a positive length.
Verify that any custom code handling libevent buffers enforces nonzero lengths before calling evbuffer_add_buffer_reference and implement defensive checks or sanitization to prevent the allocation of empty chains.

Generated by OpenCVE AI on August 28, 2026 at 19:53 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4786-1	libevent security update
Debian DSA	DSA-6493-1	libevent security update
Ubuntu USN	USN-8710-1	libevent vulnerabilities

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.121% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/libevent/libevent/commit/5cb95ba2f804f8aff46f88d58391c71e1251cd1c
https://github.com/libevent/libevent/commit/9db091b04f569be3a700fa9860ef02f90b830af9
https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable
https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha
https://github.com/libevent/libevent/security/advisories/GHSA-c2pj-cg4r-88c8
https://nvd.nist.gov/vuln/detail/CVE-2026-63381
https://www.cve.org/CVERecord?id=CVE-2026-63381

History

Nov 10, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 27, 2026 6:00 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-63381 https://www.cve.org/CVERecord?id=CVE-2026-63381
Metrics	threat_severity `None`	cvssV3_1 `{'score': 6.6, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H'}` threat_severity `Moderate`

Aug 21, 2026 1:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Libevent Project Libevent Project libevent
Vendors & Products		Libevent Project Libevent Project libevent

Aug 20, 2026 6:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbuffer_add_buffer_reference processes an output buffer whose out_total_len is zero. evbuffer_free_all_chains frees the initial empty chain without resetting outbuf->first, outbuf->last, or outbuf->last_with_datap, and APPEND_CHAIN_MULTICAST subsequently dereferences the dangling chain pointer. A caller that can drive this buffer state can cause memory corruption or a process crash. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.
Title		Libevent: Dangling Pointer in `evbuffer_add_buffer_reference`
Weaknesses		CWE-908
References		https://github.com/libevent/libevent/commit/5cb95ba2f804f8aff46f88d58391c71e1251cd1c https://github.com/libevent/libevent/commit/9db091b04f569be3a700fa9860ef02f90b830af9 https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha https://github.com/libevent/libevent/security/advisories/GHSA-c2pj-cg4r-88c8
Metrics		cvssV4_0 `{'score': 5.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N'}`