CVE-2026-88340

Name of the Vulnerable Software and Affected Versions YARA version 4.5.8

Description An invalid pointer release occurs during the deserialization of compiled .yrc rule files. The issue stems from insufficient validation of external-variable pointers, which can result in an invalid free within the yr rules destroy() function or wild pointer access in the yr object create() function. A remote attacker can trigger memory corruption and an application crash by providing a specially crafted .yrc file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.