8.4High

CVE-2026-63388

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in bufferevent_sock.c when bufferevent_socket_set_conn_address_ copies a kernel-supplied AF_UNIX peer address into bufferevent_private.conn_address. Release builds compiled with NDEBUG disable the EVUTIL_ASSERT length guard, and the evhttp accept path can pass a 110-byte sockaddr from accept() into the 28-byte field. An unauthenticated local peer able to connect to an AF_UNIX listener can overwrite the adjacent dns_request pointer and heap data, causing memory corruption with confidentiality, integrity, and availability impact. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

What this means for your business

An attacker can use it only with access to the machine itself, without a login, and without anyone at your company clicking anything.
FIRST's prediction model gives it a 0.2% chance of attack attempts being seen in the next 30 days, ranking above 8% of all known flaws.

What to do

1Ask your IT team or provider whether any of your systems use the affected product.
2If you do, follow the vendor's guidance. No patch reference has been published yet.

Not sure if your company is exposed?

Fastnexa’s certified penetration testers can check whether attackers could use this flaw, or others like it, against your websites, apps and network. The full test is free for our first 10 founding clients until 31 December 2026.

Check if you’re exposed Book a call

Scoring

CVSS: 8.4 (v3.1)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-617
Assigned by: security-advisories@github.com

Dates

Published: 2026-08-20
Last modified: 2026-09-09
Sources: NVD

What this means for your business

What to do

Not sure if your company is exposed?

Scoring

Dates

References