This vulnerability involves an off‑by‑one error in the dnsname_to_labels function of libevent’s evdns.c. The error allows a crafted DNS record to write a single byte beyond a 64 KB stack buffer, potentially overflowing the buffer and corrupting adjacent memory. The resulting out‑of‑bounds write can cause the process to crash or, with sufficient control, corrupt memory in a way that may be exploitable for further attacks. The weakness is reflected in CWE‑121, CWE‑193, and CWE‑787 identifiers for buffer overflows and improper bounds checking.

The flaw appears in libevent versions prior to release‑2.1.13 and the 2.2.x series before release‑2.2.2‑alpha. Any installation of libevent 2.1.x or 2.2.x that has not been upgraded to the patched releases is vulnerable.

The vulnerability carries a CVSS score of 7, indicating medium to high severity. No EPSS data is available, and the flaw is not listed in the CISA KEV catalog. The attack vector requires a DNS server capable of sending a crafted response containing PTR, CNAME, MX, NS, or SOA records. The crafted response can be delivered over the network, implying remote reachability. An attacker who can force the target to resolve a name or otherwise provoke evdns to format a response can trigger the overflow. The impact ranges from denial of service to potential memory corruption that could be leveraged by a skilled adversary.