CVE-2026-55246: CWE-122: Heap-based Buffer Overflow in Tatsh bincookie

The bincookie library versions before 0.1.9 contain a heap-based buffer overflow in the bincookie_init_file() function. The function allocates a buffer based on the file length but uses the file-controlled num_pages field as the loop bound for processing page sizes. This mismatch allows reading and writing beyond the allocated heap buffer. Additionally, unvalidated page sizes and cookie offsets can cause further out-of-bounds accesses during page and cookie iteration. This vulnerability can lead to application crashes, heap corruption, and potentially arbitrary code execution when parsing attacker-supplied binarycookies files. The vulnerability is addressed in version 0.1.9.

Applications using affected versions of bincookie to parse untrusted binarycookies files may crash or experience heap corruption. The heap overflow and out-of-bounds accesses can potentially be exploited to achieve arbitrary code execution. The CVSS 3.1 base score is 7.8, indicating a high severity with high impact on confidentiality, integrity, and availability. No known exploits are reported in the wild at this time.

Upgrade to bincookie version 0.1.9 or later, where this vulnerability is fixed. No other mitigations are indicated or necessary once the fixed version is applied.