Executive brief
Libevent is a widely-used event notification library that powers many networked applications and services. A use-after-free vulnerability in buffer handling could allow an attacker who can manipulate buffer operations to cause application crashes or potentially corrupt memory, affecting service availability and system stability.
Technical details
The vulnerability is a use-after-free in buffer.c's evbuffer_add_buffer_reference function. When processing an output buffer with zero out_total_len, evbuffer_free_all_chains frees the initial empty chain but fails to reset the pointers outbuf->first, outbuf->last, and outbuf->last_with_datap, leaving dangling references. The APPEND_CHAIN_MULTICAST macro subsequently dereferences these dangling pointers, leading to memory corruption. An attacker who can drive this buffer state through application-specific APIs can trigger a crash or memory corruption. The issue is fixed in libevent 2.1.13 and 2.2.2-alpha.
Affected products
- Libevent libevent before 2.1.13, before 2.2.2-alpha
Timeline
- 2026-08-20: disclosed
- 2026-08-20: patched: Fixed in versions 2.1.13 and 2.2.2-alpha