#1148825 yara: CVE-2026-88340 CVE-2026-88341

#1148825#5
Date:
2026-09-24 06:31:39 UTC
From:
To:
Hi,

The following vulnerabilities were published for yara.

CVE-2026-88340[0]:
| An invalid pointer release vulnerability exists in YARA 4.5.8 during
| deserialization of compiled .yrc rule files. The vulnerability is
| caused by insufficient validation of external-variable pointers,
| which may lead to invalid free in yr_rules_destroy() or wild pointer
| access in yr_object_create(). An attacker can provide a specially
| crafted .yrc file that causes memory corruption and application
| crash.


CVE-2026-88341[1]:
| A reachable assertion vulnerability exists in YARA 4.5.8 when
| loading crafted .yrc compiled rule files. An attacker can provide a
| malicious file with an invalid arena configuration (num_buffers=0)
| that triggers an assertion failure in yr_arena_get_ptr(), causing
| the application to terminate.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-88340
https://www.cve.org/CVERecord?id=CVE-2026-88340
[1] https://security-tracker.debian.org/tracker/CVE-2026-88341
https://www.cve.org/CVERecord?id=CVE-2026-88341

Regards,
Salvatore