Is CVE-2026-63388 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63388 being exploited in the wild.

How severe is CVE-2026-63388?

High severity, with a CVSS score of 8.4, published 20 August 2026.

Which products and versions are affected?

Libevent prior to 2.1.13 and prior to 2.2.2-alpha.

Is there a fix for CVE-2026-63388?

A patch was published on 2026-08-20: Fixed in versions 2.1.13 and 2.2.2-alpha Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-63388 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-63388?

Check whether you run Libevent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63388: Libevent heap out-of-bounds write in bufferevent_sock

CVE-2026-63388 · Severity: high · CVSS 8.4 · Published 2026-08-20

Libevent is an event notification library used by many applications to handle network I/O and timers. A local attacker able to connect to an AF_UNIX socket can craft a malicious peer address that overflows a heap buffer in the library, corrupting adjacent memory. This could allow an attacker to crash the application, read sensitive data from memory, or potentially execute arbitrary code.

Technologies: Libevent. Vendors: Libevent.

Quick answers

Is CVE-2026-63388 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63388 being exploited in the wild.
How severe is CVE-2026-63388?: High severity, with a CVSS score of 8.4, published 20 August 2026.
Which products and versions are affected?: Libevent prior to 2.1.13 and prior to 2.2.2-alpha.
Is there a fix for CVE-2026-63388?: A patch was published on 2026-08-20: Fixed in versions 2.1.13 and 2.2.2-alpha Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63388 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-63388?: Check whether you run Libevent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a heap out-of-bounds write (CWE-122) in bufferevent_socket_set_conn_address_ in bufferevent_sock.c. When an AF_UNIX socket connection is accepted by an evhttp server compiled with NDEBUG (which disables assertions), the kernel-supplied peer address (up to 110 bytes) is copied into a 28-byte field without proper length validation. The EVUTIL_ASSERT guard that would catch this is disabled in release builds. An unauthenticated local peer connecting to the AF_UNIX listener can trigger the overflow, overwriting the adjacent dns_request pointer and other heap data. The fix unconditionally validates address length and allocates sufficient storage for AF_UNIX addresses. Patches are available in libevent 2.1.13 and 2.2.2-alpha.

Affected products

Libevent Libevent prior to 2.1.13 and prior to 2.2.2-alpha

Timeline

2026-08-20: disclosed
2026-08-20: patched: Fixed in versions 2.1.13 and 2.2.2-alpha

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.