Executive brief
Libevent is an event notification library used by many applications to handle network I/O and timers. A local attacker able to connect to an AF_UNIX socket can craft a malicious peer address that overflows a heap buffer in the library, corrupting adjacent memory. This could allow an attacker to crash the application, read sensitive data from memory, or potentially execute arbitrary code.
Technical details
The vulnerability is a heap out-of-bounds write (CWE-122) in bufferevent_socket_set_conn_address_ in bufferevent_sock.c. When an AF_UNIX socket connection is accepted by an evhttp server compiled with NDEBUG (which disables assertions), the kernel-supplied peer address (up to 110 bytes) is copied into a 28-byte field without proper length validation. The EVUTIL_ASSERT guard that would catch this is disabled in release builds. An unauthenticated local peer connecting to the AF_UNIX listener can trigger the overflow, overwriting the adjacent dns_request pointer and other heap data. The fix unconditionally validates address length and allocates sufficient storage for AF_UNIX addresses. Patches are available in libevent 2.1.13 and 2.2.2-alpha.
Affected products
- Libevent Libevent prior to 2.1.13 and prior to 2.2.2-alpha
Timeline
- 2026-08-20: disclosed
- 2026-08-20: patched: Fixed in versions 2.1.13 and 2.2.2-alpha