Search: CVE-2026-63388

Libevent versions prior to 2.1.13 and 2.2.2-alpha contain a heap out-of-bounds write vulnerability in bufferevent_sock.c. This occurs when bufferevent_socket_set_conn_address_ copies a kernel-supplied AF_UNIX peer address into a buffer that is too small, potentially causing memory corruption. The flaw allows an unauthenticated local peer connecting to an AF_UNIX listener to overwrite adjacent heap data, impacting confidentiality, integrity, and availability. The issue is fixed in versions 2.1.13 and 2.2.2-alpha.