Log in Start free

Vulnerability · Published Sep 22, 2026 · Assigned by mitre

CVE-2026-88340

High 7.6

In plain English

A high-severity security flaw in the yara package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)7.6High
Exploit odds (30 days)0.2%top 83.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An invalid pointer release vulnerability exists in YARA 4.5.8 during deserialization of compiled .yrc rule files. The vulnerability is caused by insufficient validation of external-variable pointers, which may lead to invalid free in yr_rules_destroy() or wild pointer access in yr_object_create(). An attacker can provide a specially crafted .yrc file that causes memory corruption and application crash.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12yarano fix listedDEBIAN-CVE-2026-88340
Debian:13yarano fix listedDEBIAN-CVE-2026-88340
Debian:14yarano fix listedDEBIAN-CVE-2026-88340
Ubuntu:24.04:LTSyarano fix listedUBUNTU-CVE-2026-88340
Ubuntu:26.04:LTSyarano fix listedUBUNTU-CVE-2026-88340
Ubuntu:26.10yarano fix listedUBUNTU-CVE-2026-88340

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-763 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H

References