Quick answers
- Is CVE-2026-76987 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-76987 being exploited in the wild.
- How severe is CVE-2026-76987?
- High severity, with a CVSS score of 7.3, published 20 August 2026.
- Which products and versions are affected?
- liftoff-sr CIPster before commit e745d9d4a8ca3a13689066983a1269fe1e567674.
- Is there a fix for CVE-2026-76987?
- A patch was published on 2026-06-01: Patch commit e745d9d4a8ca3a13689066983a1269fe1e567674 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-76987 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-76987?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a buffer overflow in the CipAttribute::GetAttrData and CipAttribute::SetAttrData functions (ciptypes.h). The root cause is insufficient bounds checking on byte-array attribute length: a remote attacker can send a SetAttributeSingle message with an attacker-controlled length value that is not validated against the actual buffer capacity. This allows out-of-bounds reads (information disclosure) and out-of-bounds writes (memory corruption). The attack is network-reachable and requires no authentication. The patch (commit e745d9d4a8ca3a13689066983a1269fe1e567674) introduces a CipByteArray type that tracks capacity immutably, preventing length inflation past the allocation.
Affected products
- liftoff-sr CIPster before commit e745d9d4a8ca3a13689066983a1269fe1e567674
Timeline
- 2026-08-20: disclosed
- 2026-06-01: patched: Patch commit e745d9d4a8ca3a13689066983a1269fe1e567674