CVE-2026-56123

Name of the Vulnerable Software and Affected Versions socat versions 1.8.0.0 through 1.8.1.1

Description A heap-based buffer overflow exists in the SOCKS5 DOMAINNAME reply parser during proxy connection setup. The issue stems from a sign-extension flaw where the domain name length byte is read as a signed char, potentially resulting in a negative bytes to read value. This value is implicitly converted to size t, leading to an unbounded heap write into a 262-byte reply buffer with attacker-controlled size and content. A malicious or compromised SOCKS5 proxy server can exploit this to cause a process crash, denial of service, or potential remote code execution via heap corruption.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.