CVE-2026-88370

Name of the Vulnerable Software and Affected Versions libconfini version 1.16.4

Description A heap out-of-bounds write condition exists involving the bundled load ini buffer.h utility and the strip ini cache() function. The utility allocates exactly ini length bytes, but strip ini cache() writes a NUL terminator at ini source[ini length], which requires an additional writable byte. This can lead to deterministic heap memory corruption when processing any non-empty INI input, potentially resulting in a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.