Vulnerability · Published Mar 12, 2026 · Assigned by VulDB

CVE-2026-4012rxi fe fe.c read_ out-of-bounds

Low 3.3

In plain English

A low-severity out-of-bounds read in fe from rxi. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).

Severity (CVSS 3.1)3.3Low

Exploit odds (30 days)0.1%top 98.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in rxi fe up to ed4cda96bd582cbb08520964ba627efb40f3dd91. The impacted element is the function read_ of the file src/fe.c. This manipulation with the input 1 causes out-of-bounds read. The attack requires local access. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

Affected products (as reported)

Vendor	Product	Versions
rxi	fe	ed4cda96bd582cbb08520964ba627efb40f3dd91

Weakness: CWE-125, CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

References

VDB-350534 | rxi fe fe.c read_ out-of-bounds vdb-entry, technical-description
VDB-350534 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #769774 | rxi fe master-branch Out-of-Bounds Read third-party-advisory
https://github.com/rxi/fe/issues/34 issue-tracking
https://github.com/oneafter/0211/blob/main/fe/repro exploit
https://github.com/rxi/fe/ product