Executive brief
libucl is a library used by applications to parse configuration files. A vulnerability exists where a specially crafted configuration file can cause the application to crash or potentially expose sensitive information. This could lead to a service outage or unauthorized data access if an attacker can convince a user or system to process a malicious configuration file.
Technical details
A vulnerability exists in libucl's `ucl_object_emit` function due to improper handling of embedded null bytes in keys when the parser is in `UCL_PARSER_ZEROCOPY` mode. The root cause is an out-of-bounds read (CWE-125) in `ucl_elt_string_write_json` within `src/ucl_emitter_utils.c`, which assumes keys are standard null-terminated C strings. An attacker can exploit this by providing a crafted UCL input, leading to a segmentation fault (SEGV) or potential memory disclosure. The issue is confirmed in versions up to 0.9.4.
Affected products
- vstakhov libucl up to and including 0.9.4
Timeline
- 2025-05-15: disclosed: Issue reported on GitHub repository
- 2026-03-17: advisory: CVE published by Fedora Project