YARA 4.5.8 has a memory corruption vulnerability that occurs when deserializing compiled .yrc rule files. The flaw is caused by the program’s lack of validation of external‑variable pointers, which can lead to an invalid free in yr_rules_destroy() or a wild pointer access in yr_object_create(). An adversary who can supply a malicious .yrc file is able to trigger memory corruption, causing the application to crash without any requirement for remote code execution.

Systems that run YARA 4.5.8 and process compiled rule files are affected. This typically includes malware‑analysis workstations, security scanners, continuous integration pipelines, and any other environment that loads or evaluates .yrc files. The impact is observed whenever a malformed file is deserialized, leading to an application failure.

The vulnerability requires an attacker to provide a crafted rule file to the YARA process; the attack vector is therefore limited to scenarios where untrusted or externally supplied rule files are loaded. The CVSS score of 7.6 indicates high severity. The EPSS score of <1% indicates a very low probability of exploitation, and the issue is not listed in the CISA KEV catalog, implying no documented public exploitation yet. However, because memory corruption can lead to a denial of service, the risk remains non‑trivial and mitigation should be applied promptly.