Description
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbuffer_add_buffer_reference processes an output buffer whose out_total_len is zero. evbuffer_free_all_chains frees the initial empty chain without resetting outbuf->first, outbuf->last, or outbuf->last_with_datap, and APPEND_CHAIN_MULTICAST subsequently dereferences the dangling chain pointer. A caller that can drive this buffer state can cause memory corruption or a process crash. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.
Published: 2026-08-20
Score: 5.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A use‑after‑free occurs in libevent’s evbuffer_add_buffer_reference when handling an output buffer whose out_total_len is zero. The function frees an empty chain without resetting linked‑list pointers, and a subsequent APPEND_CHAIN_MULTICAST dereferences the stale pointer. The defect is classified as CWE‑908 and can lead to memory corruption or a process crash.

Affected Systems

The affected products are libevent library releases prior to 2.1.13 and 2.2.2‑alpha. Versions before these releases contain the flaw; the issue is fixed in 2.1.13 and the unstable 2.2.2‑alpha release. Applications linked against the vulnerable library are at risk.

Risk and Exploitability

The CVSS score of 5.8 indicates moderate severity. An EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to influence the creation of a zero‑length output buffer—an input that can be controlled within applications using libevent—to trigger the use‑after‑free. The impact is local.

Generated by OpenCVE AI on August 21, 2026 at 02:54 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade libevent to version 2.1.13 or newer, which removes the dangling‑pointer bug.
  • If an upgrade cannot be performed immediately, audit code paths that create output buffers and ensure that out_total_len never equals zero before calling evbuffer_add_buffer_reference; add defensive checks or sanitization to enforce a positive length.
  • Verify that any custom code handling libevent buffers enforces nonzero lengths before calling evbuffer_add_buffer_reference and implement defensive checks or sanitization to prevent the allocation of empty chains.

Generated by OpenCVE AI on August 21, 2026 at 02:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 21 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
First Time appeared Libevent Project
Libevent Project libevent
Vendors & Products Libevent Project
Libevent Project libevent

Thu, 20 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Description Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbuffer_add_buffer_reference processes an output buffer whose out_total_len is zero. evbuffer_free_all_chains frees the initial empty chain without resetting outbuf->first, outbuf->last, or outbuf->last_with_datap, and APPEND_CHAIN_MULTICAST subsequently dereferences the dangling chain pointer. A caller that can drive this buffer state can cause memory corruption or a process crash. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.
Title Libevent: Dangling Pointer in `evbuffer_add_buffer_reference`
Weaknesses CWE-908
References
Metrics cvssV4_0

{'score': 5.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Libevent Project Libevent
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-20T17:50:09.322Z

Reserved: 2026-07-16T17:39:30.171Z

Link: CVE-2026-63381

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-20T18:16:35.530

Modified: 2026-08-20T18:16:35.530

Link: CVE-2026-63381

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T13:01:14Z

Weaknesses
  • CWE-908

    Use of Uninitialized Resource