CVE-2026-107161: Heap-based Buffer Overflow in Red Hat Red Hat Enterprise Linux 10

The vulnerability exists in the add_to_challenge() function of the DIGEST-MD5 plugin in Cyrus SASL, where the buffer size is computed before quoting special characters but not recalculated after quoting, resulting in an undersized buffer. This buffer is then used with strcat(), causing a heap-based buffer overflow. A malicious or man-in-the-middle DIGEST-MD5 or HTTP Digest server can exploit this by sending a specially crafted challenge field such as realm or nonce to a connecting client, likely causing a client application crash.

Successful exploitation can lead to a heap-based buffer overflow in the client application, which may cause a crash and potentially allow execution of arbitrary code. The CVSS score of 7.5 indicates high severity with impacts on confidentiality, integrity, and availability. However, no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-107161 for current remediation guidance. Until a patch is applied, avoid connecting to untrusted DIGEST-MD5 or HTTP Digest servers to reduce risk.