CVE-2026-63387: libevent Stack-based Buffer Overflow

Vulnerability summary

CVE-2026-63387 is a high (CVSS 7.0) Stack-based Buffer Overflow vulnerability in libevent. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 34.7% of scored vulnerabilities.

Timeline

1. 20-08-2026
   PublishedVulnerability first disclosed.
2. 25-08-2026
   Last modifiedVulnerability information updated.

Description

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdns_server_request_format_response. The final-label check permits j plus label_len plus one to equal buf_len, after which the terminating null byte is written to buf[buf_len]. A crafted DNS server response containing PTR, CNAME, MX, NS, or SOA data can trigger the one-byte out-of-bounds write and crash or corrupt the process. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

• CWE-121Stack-based Buffer OverflowA stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
• CWE-193Off-by-one ErrorA product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.