Description
Buffer Overflow vulnerability in madmurphy libconfini v.1.16.4 allows a remote attacker to cause a denial of service via an allocation-size mismatch between its bundled load_ini_buffer utility and strip_ini_cache()
Published: 2026-10-13
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Denial of Service
Action: Apply Update
AI Analysis

Impact

This vulnerability is a buffer overflow in the libconfini library. A remote attacker can trigger the overflow by sending specially crafted input to load_ini_buffer, causing an allocation-size mismatch with strip_ini_cache and resulting in a denial of service that crashes the process.

Affected Systems

The affected product is libconfini version 1.16.4, developed by madmurphy. No other versions or vendors are listed in the CNA data.

Risk and Exploitability

The vulnerability can be exploited remotely, as the overflow is triggered by external input. Formal severity metrics such as CVSS and EPSS are not available, but the denial-of-service impact can bring down services that rely on the library. The vulnerability is not listed in CISA's KEV catalog, indicating no confirmed public exploitation at the time of this report.

Generated by OpenCVE AI on October 17, 2026 at 07:17 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade libconfini to version 1.16.5 or later where the buffer overflow is fixed.
  • If an upgrade cannot be applied immediately, avoid using functions that invoke load_ini_buffer or strip_ini_cache until a fix is available.
  • Monitor logs for crashes or anomalies related to libconfini and block suspicious input at the application layer.

Generated by OpenCVE AI on October 17, 2026 at 07:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 17 Oct 2026 07:45:00 +0000

Type Values Removed Values Added
Title Buffer Overflow in libconfini Leading to Remote Denial of Service

Thu, 15 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-120
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 20:00:00 +0000

Type Values Removed Values Added
First Time appeared Madmurphy
Madmurphy libconfini
Vendors & Products Madmurphy
Madmurphy libconfini

Tue, 13 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Description Buffer Overflow vulnerability in madmurphy libconfini v.1.16.4 allows a remote attacker to cause a denial of service via an allocation-size mismatch between its bundled load_ini_buffer utility and strip_ini_cache()
References

Subscriptions

Madmurphy Libconfini
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-10-15T14:40:16.704Z

Reserved: 2026-09-22T00:00:00.000Z

Link: CVE-2026-95124

cve-icon Vulnrichment

Updated: 2026-10-15T14:39:37.976Z

cve-icon NVD

Status : Deferred

Published: 2026-10-13T15:17:51.803

Modified: 2026-10-16T19:56:15.773

Link: CVE-2026-95124

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T07:30:04Z

Weaknesses
  • CWE-120

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')