Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in bufferevent_sock.c when bufferevent_socket_set_conn_address_ copies a… (CVE-2026-63388)

Libevent, an event notification library, has a heap out-of-bounds write vulnerability in versions prior to 2.1.13 and 2.2.2-alpha. The vulnerability arises in bufferevent_sock.c when bufferevent_socket_set_conn_address_ copies an AF_UNIX peer address from the kernel into a fixed-size buffer without adequate bounds checking. Release builds compiled with NDEBUG disable the EVUTIL_ASSERT length guard, allowing a 110-byte sockaddr from accept() to overflow a 28-byte buffer. An unauthenticated local peer connecting to an AF_UNIX listener can exploit this to overwrite the adjacent dns_request pointer and other heap data, leading to memory corruption with potential confidentiality, integrity, and availability impacts. This vulnerability is resolved in libevent versions 2.1.13 and 2.2.2-alpha.

An unauthenticated local attacker able to connect to an AF_UNIX listener can trigger a heap out-of-bounds write, causing memory corruption. This can compromise confidentiality, integrity, and availability of the affected system. The vulnerability affects local privilege boundaries and requires local access to the AF_UNIX socket.

This vulnerability is fixed in libevent versions 2.1.13 and 2.2.2-alpha. Users should upgrade to these or later versions to remediate the issue. No vendor advisory indicating alternative mitigations or 'no action required' was provided. Patch status is confirmed by the version fix information.