CVE-2026-88370: libconfini · Heap-based Buffer Overflow
Affects libconfiniSource CVE Database V5
Not known to be exploited · CVSS 5.3 Medium.
Data as of 26 Oct 2026, 13:47 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 28% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitation evidence
Disclosed: evidence found.
CVE published 24 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
GitHubmadmurphy/libconfinipkg:github/madmurphy/libconfiniOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Until a fix is available, avoid using the vulnerable bundled load_ini_buffer.h utility with untrusted INI inputs or apply custom bounds checking to prevent out-of-bounds writes.
Description
libconfini version 1.16.4 contains a heap out-of-bounds write vulnerability in its bundled load_ini_buffer.h utility, specifically in the strip_ini_cache() function. The utility allocates memory exactly equal to the INI input length but then writes a null terminator beyond the allocated buffer, causing heap memory corruption. This flaw can lead to a denial of service when processing any non-empty INI input.