CVE-2026-63388: 
MySQL vulnerability analysis and mitigation

CVE-2026-63388 is a heap out-of-bounds write vulnerability in libevent's bufferevent_socket_set_conn_address_ function (bufferevent_sock.c), reachable via AF_UNIX socket accept in the evhttp path. It affects libevent versions prior to 2.1.13 and 2.2.0-alpha through 2.2.1-alpha (i.e., prior to 2.2.2-alpha). The vulnerability was discovered by researcher @mat-mo and disclosed on July 1, 2026 via GitHub Security Advisory GHSA-cvq5-vrvr-j338, with NVD publication on August 20, 2026. It carries a CVSS v3.1 base score of 8.4 (High) (GitHub Advisory, Feedly).

The root cause is a size-unchecked memcpy in bufferevent_socket_set_conn_address_ (bufferevent_sock.c:119–126), classified as CWE-787 (Out-of-bounds Write) and CWE-617 (Reachable Assertion). The function copies a kernel-supplied sockaddr into a 28-byte conn_address union field (sized for sockaddr_in6) guarded only by an EVUTIL_ASSERT, which becomes a no-op when libevent is compiled with -DNDEBUG (the default for release builds). For AF_UNIX listeners, a peer may bind to an abstract-namespace name up to 108 bytes long, causing accept() to return socklen = 110; the evhttp accept path (listener_read_cb → accept_socket_cb → evhttp_get_request_connection) then passes this 110-byte sockaddr directly into the 28-byte field, producing a controlled linear heap overflow of ~74 bytes past the bufferevent_socket allocation. The overflow overwrites the adjacent dns_request pointer (8 bytes inside the allocation) and up to 62 bytes of the subsequent evbuffer struct, including its lock pointer, which is later passed to pthread_mutex_lock, yielding a controlled pointer dereference (GitHub Advisory, Fix Commit 52057cb).

Successful exploitation allows an unauthenticated local process that can connect to the libevent server's AF_UNIX socket to corrupt heap memory, overwrite the dns_request pointer and adjacent evbuffer fields (including the mutex lock pointer), and trigger a controlled pointer dereference within pthread_mutex_lock. This results in high confidentiality impact (memory disclosure), high integrity impact (heap data modification), and high availability impact (service crash or potential code execution). On servers built with evthread_use_pthreads() (standard production configuration), the attacker controls 48 bits of the corrupted lock pointer — matching the full user-space address range on x86_64/aarch64 — making this RCE-capable under favorable heap layout conditions, though ASLR requires an additional info-leak primitive or brute force (GitHub Advisory).

A detailed proof-of-concept (PoC) is publicly available in the GitHub Security Advisory, including a vulnerable server, exploit client, and Docker-based reproduction environment demonstrating both ASan detection and controlled SIGSEGV at an attacker-chosen address. The advisory confirms the bug is reachable by any unauthenticated local process able to connect() to the AF_UNIX listener, with no privileges required. As of the disclosure date, there is no evidence of in-the-wild exploitation or threat actor attribution, and the NVD SSVC assessment lists exploitation as "none" (GitHub Advisory, Feedly). The EPSS score is approximately 0.144%, and the vulnerability is not listed in the CISA KEV catalog (Feedly).

1. Identify target: Locate a process running an evhttp server over an AF_UNIX socket using a release build of libevent (compiled with -DNDEBUG) in versions prior to 2.1.13 or 2.2.2-alpha. Check for socket files (e.g., /tmp/*.sock) or enumerate running services.
2. Craft malicious AF_UNIX address: Create a sockaddr_un with sun_family = AF_UNIX and populate sun_path with an abstract-namespace name (first byte \0) filled with a chosen byte pattern up to 108 bytes. Place an attacker-controlled 8-byte pointer value at sun_path[102..109] to target the evbuffer.lock field in the adjacent heap chunk.
3. Bind and connect: Call bind() on a new AF_UNIX socket with the crafted address (resulting in socklen = 110), then connect() to the target server's Unix socket path.
4. Trigger the overflow: Send a minimal HTTP request (e.g., GET / HTTP/1.0\r\n\r\n). The server's listener_read_cb → accept_socket_cb → evhttp_get_request_connection call chain invokes bufferevent_socket_set_conn_address_ with the 110-byte kernel-supplied sockaddr, triggering the memcpy into the 28-byte field and overwriting ~74 bytes of adjacent heap data.
5. Achieve controlled dereference: The corrupted evbuffer.lock pointer is passed to pthread_mutex_lock via EVBUFFER_LOCK(input) in evhttp_start_read_, causing a SIGSEGV at the attacker-chosen address. With a known heap layout (e.g., via a fork-server or info-leak), this can be escalated to arbitrary code execution (GitHub Advisory).

• Process: Unexpected crash (SIGSEGV) of a libevent-based service process; dmesg or coredump showing fault address matching a non-canonical or patterned pointer (e.g., 0xcccccccccccc) inside pthread_mutex_lock.
• Logs: Application crash logs or coredumps with stack traces referencing evhttp_start_read_, evhttp_get_request, accept_socket_cb, listener_read_cb, and ___pthread_mutex_lock with an unusual mutex= argument.
• File System: Coredump files generated by the libevent service process in /var/crash/, /tmp/, or the working directory of the service.
• Network/Socket: Unexpected AF_UNIX connections to the service socket from processes with abstract-namespace socket names (visible via ss -xp or lsof) containing high-entropy or patterned data in the socket name field.
• ASan output (if applicable): AddressSanitizer: heap-buffer-overflow report with WRITE of size 110 at bufferevent_sock.c:125 or http.c:4686 in the stack trace (GitHub Advisory).

Upgrade libevent to version 2.1.13-stable (stable branch) or 2.2.2-alpha (development branch), both released July 1, 2026, which fix the issue by replacing the EVUTIL_ASSERT-guarded memcpy with an unconditional length check and expanding conn_address to struct sockaddr_storage (128 bytes) (Release 2.1.13, Release 2.2.2-alpha). As a workaround prior to patching, restrict filesystem or abstract-namespace permissions on AF_UNIX sockets used by libevent applications to trusted local users only (e.g., via filesystem permissions or SELinux/AppArmor policy), and limit which local processes can connect to the socket. Rebuilding libevent without -DNDEBUG will convert the heap overflow into an assertion failure/abort, which is less exploitable but still causes a denial of service (GitHub Advisory).

The vulnerability was reported by researcher @mat-mo and fixed by libevent maintainer @nmathewson as part of a broader security release (2.1.13-stable) that addressed multiple CVEs across evbuffer, bufferevent, evtag, evrpc, evdns, and evhttp modules. The Yocto Project security mailing list flagged the issue for embedded Linux distributions, and Mageia issued a distribution advisory. Tenable published Nessus detection plugins (IDs 338700 and 342219) for the vulnerability (Tenable, Yocto Security).