Source: yara Version: 4.5.8-1 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for yara. CVE-2026-88340[0]: | An invalid pointer release vulnerability exists in YARA 4.5.8 during | deserialization of compiled .yrc rule files. The vulnerability is | caused by insufficient validation of external-variable pointers, | which may lead to invalid free in yr_rules_destroy() or wild pointer | access in yr_object_create(). An attacker can provide a specially | crafted .yrc file that causes memory corruption and application | crash. CVE-2026-88341[1]: | A reachable assertion vulnerability exists in YARA 4.5.8 when | loading crafted .yrc compiled rule files. An attacker can provide a | malicious file with an invalid arena configuration (num_buffers=0) | that triggers an assertion failure in yr_arena_get_ptr(), causing | the application to terminate. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-88340 https://www.cve.org/CVERecord?id=CVE-2026-88340 [1] https://security-tracker.debian.org/tracker/CVE-2026-88341 https://www.cve.org/CVERecord?id=CVE-2026-88341 Regards, Salvatore
