CVE-2026-63388

The vulnerability is a heap out‑of‑bounds write triggered when the function bufferevent_socket_set_conn_address_ copies a kernel‑supplied AF_UNIX peer address into an overly small buffer. Prior to libevent 2.1.13 and 2.2.2‑alpha, the library did not guard against this overflow in release builds compiled with NDEBUG. An unauthenticated local peer that can connect to an AF_UNIX listener can supply a 110‑byte sockaddr, causing a 28‑byte field to be overwritten. This memory corruption can overwrite adjacent heap objects such as dns_request pointers, leading to confidentiality, integrity, and availability disruption, potentially enabling arbitrary code execution.

All releases of libevent before 2.1.13 and 2.2.2‑alpha are affected. Vulnerable versions include any 2.x branches prior to 2.1.13 and 2.2.2‑alpha; the fix is incorporated in the 2.1.13 stable release and the 2.2.2‑alpha development build.

The CVSS score of 8.4 indicates high severity. EPSS is not available, and the vulnerability is not listed in CISA KEV, suggesting no widely reported exploitation. The likely attack vector is local and unauthenticated; an attacker must have access to the same host and be able to open the AF_UNIX listening socket. If such access is possible, the defect can be exploited to overwrite heap memory, potentially leading to arbitrary code execution or crash.