CVE-2026-88341

Published: Sep 22, 2026Modified: Sep 24, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploitability: 1.8 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

A reachable assertion vulnerability exists in YARA 4.5.8 when loading crafted .yrc compiled rule files. An attacker can provide a malicious file with an invalid arena configuration (num_buffers=0) that triggers an assertion failure in yr_arena_get_ptr(), causing the application to terminate.

Related CWEs

CWE-617

Reachable Assertion

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

References (3)

https://github.com/NOUIY/yara/commit/0cdff36723cd260243bb2b330bda555693354760

Source: cve@mitre.org

https://github.com/VirusTotal/yara/issues/2238

Source: cve@mitre.org

https://github.com/VirusTotal/yara/issues/2238

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.