CVE-2026-102507

Name of the Vulnerable Software and Affected Versions Sliver C2 framework versions prior to 1.7.8

Description An unhandled panic exists in the operator gRPC handler. An attacker controlling a compromised implant can crash the teamserver by returning a malformed or empty Download response. By sending zero-length or 1-3 byte data payloads through a hostile implant session, an out-of-bounds slice access is triggered in the BinaryMagic() function of the vendored Binject library. This failure propagates through the operator gRPC interceptor chain and terminates the server process, disconnecting all operators.

Recommendations Update Sliver C2 framework to version 1.7.8 or later.