CVE-2026-63388

Name of the Vulnerable Software and Affected Versions Libevent versions prior to 2.1.13 Libevent versions prior to 2.2.2-alpha

Description A heap out-of-bounds write occurs in bufferevent sock.c when the function bufferevent socket set conn address () copies a kernel-supplied AF UNIX peer address into bufferevent private.conn address. In release builds compiled with NDEBUG, the EVUTIL ASSERT length guard is disabled, allowing the evhttp accept path to pass a 110-byte sockaddr from accept() into a 28-byte field. An unauthenticated local peer connecting to an AF UNIX listener can overwrite the adjacent dns request pointer and heap data, leading to memory corruption.

Recommendations Update to version 2.1.13. Update to version 2.2.2-alpha.