Executive brief
socat is a versatile networking tool used to establish bidirectional data transfers between different endpoints. A vulnerability in its SOCKS5 proxy handling allows a malicious proxy server to crash the application or potentially execute unauthorized code on the system using socat. This could lead to a complete compromise of the data being transferred or the host machine itself.
Technical details
A heap-based buffer overflow exists in socat's SOCKS5 DOMAINNAME reply parser due to a sign-extension flaw. During the connection handshake, the domain name length byte is processed through a signed char field; if the high bit is set, it results in a negative value for the bytes_to_read variable. When this value is implicitly converted to a size_t for the subsequent read operation, it becomes a very large positive integer, leading to an unbounded heap write into a fixed 262-byte buffer. An attacker controlling a SOCKS5 proxy server can exploit this to achieve remote code execution or a denial of service. The vulnerability is fixed in version 1.8.1.2.
Affected products
- socat socat 1.8.0.0 through 1.8.1.1
Timeline
- 2026-06-25: disclosed
- 2026-06-25: advisory