# CVE-2026-63381: Libevent use-after-free in evbuffer_add_buffer_reference

Source: https://junglewise.ai/threats/cve-2026-63381-libevent-use-after-free-in-evbuffer-add-buffer-reference  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-63381 · Severity: info · Published 2026-08-20

Libevent is a widely-used event notification library that powers many networked applications and services. A use-after-free vulnerability in buffer handling could allow an attacker who can manipulate buffer operations to cause application crashes or potentially corrupt memory, affecting service availability and system stability.

Technologies: [Libevent](https://junglewise.ai/threats/technologies/libevent). Vendors: [Libevent](https://junglewise.ai/threats/vendors/libevent).

## Quick answers

**Is CVE-2026-63381 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63381 being exploited in the wild.

**How severe is CVE-2026-63381?** Informational severity, published 20 August 2026.

**Which products and versions are affected?** Libevent before 2.1.13, before 2.2.2-alpha.

**Is there a fix for CVE-2026-63381?** A patch was published on 2026-08-20: Fixed in versions 2.1.13 and 2.2.2-alpha Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63381 attacked?** It is attacked over the network or with local access.

**Am I affected by CVE-2026-63381?** Check whether you run Libevent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a use-after-free in buffer.c's evbuffer_add_buffer_reference function. When processing an output buffer with zero out_total_len, evbuffer_free_all_chains frees the initial empty chain but fails to reset the pointers outbuf->first, outbuf->last, and outbuf->last_with_datap, leaving dangling references. The APPEND_CHAIN_MULTICAST macro subsequently dereferences these dangling pointers, leading to memory corruption. An attacker who can drive this buffer state through application-specific APIs can trigger a crash or memory corruption. The issue is fixed in libevent 2.1.13 and 2.2.2-alpha.

## Affected products

- Libevent libevent before 2.1.13, before 2.2.2-alpha

## Timeline

- 2026-08-20: disclosed
- 2026-08-20: patched: Fixed in versions 2.1.13 and 2.2.2-alpha

## References

- [https://github.com/libevent/libevent/commit/5cb95ba2f804f8aff46f88d58391c71e1251cd1c](https://github.com/libevent/libevent/commit/5cb95ba2f804f8aff46f88d58391c71e1251cd1c)
- [https://github.com/libevent/libevent/commit/9db091b04f569be3a700fa9860ef02f90b830af9](https://github.com/libevent/libevent/commit/9db091b04f569be3a700fa9860ef02f90b830af9)

## Related threats

- [Libevent WebSocket unbounded memory accumulation via frame fragmentation](https://junglewise.ai/threats/cve-2026-63495-libevent-websocket-unbounded-memory-accumulation-via-frame)
- [Libevent heap out-of-bounds write in bufferevent_sock](https://junglewise.ai/threats/cve-2026-63388-libevent-heap-out-of-bounds-write-in-bufferevent-sock)
- [Libevent off-by-one stack buffer overflow in DNS response parsing](https://junglewise.ai/threats/cve-2026-63387-libevent-off-by-one-stack-buffer-overflow-in-dns-response-parsing)
- [Libevent integer overflow in evtag_unmarshal_header](https://junglewise.ai/threats/cve-2026-63384-libevent-integer-overflow-in-evtag-unmarshal-header)
- [Libevent out-of-bounds read in event_tagging](https://junglewise.ai/threats/cve-2026-63383-libevent-out-of-bounds-read-in-event-tagging)