Vulnerability · Published Oct 15, 2026 · Assigned by GitHub_M

CVE-2026-55246bincookie: Heap buffer overflow via unvalidated `num_pages` when parsing a `.binarycookies` file

High 7.8

In plain English

A high-severity heap buffer overflow in bincookie from Tatsh. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.2%top 87.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

bincookie is a header-only binarycookies parser. Prior to 0.1.9, bincookie_init_file() in bincookie.h allocates a buffer using the actual .binarycookies file length but trusts the file-controlled num_pages field as the loop bound for byte-swapping page_sizes entries. A crafted file can make the loop read and write beyond the heap allocation, and related unvalidated page sizes and cookie_offsets can drive additional out-of-bounds accesses in page and cookie iteration. Applications that parse an attacker-supplied binarycookies file may crash or suffer heap corruption that can potentially enable code execution. This issue is fixed in version 0.1.9.

Affected products (as reported)

Vendor	Product	Versions
Tatsh	bincookie	< 0.1.9

Weakness: CWE-122, CWE-787 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://github.com/Tatsh/bincookie/security/advisories/GHSA-22pc-xxw4-q849 x_refsource_CONFIRM
https://github.com/Tatsh/bincookie/commit/bc1433c1ee4d0284750ff85c8437f1b8df91ab3b x_refsource_MISC
https://github.com/Tatsh/bincookie/releases/tag/v0.1.9 x_refsource_MISC