CVE-2026-102360
Description
A flaw was found in lib0. A missing bounds check in the binary decoder allows data to be read beyond the boundaries of the allocated buffer. An unauthenticated remote attacker could exploit this vulnerability by sending a specially crafted payload with an excessive length prefix. This can result in information disclosure, potentially exposing sensitive process memory such as authentication tokens or confidential application data.
Statement
A flaw of IMPORTANT severity was found in the lib0 binary decoder, which is bundled as an npm dependency in Fedora and EPEL community packages such as jupyterlab, nextcloud, python-ipyparallel, python-nbdime, python-jupytext, and python-jupyterlab_pygments. The readUint8Array function does not validate a wire-supplied length prefix against the decoder's own buffer bounds, so an unauthenticated remote attacker who can supply bytes to a lib0 decoder, including before authentication, can use a crafted payload with an excessive length prefix to read process memory beyond the allocated buffer. Where the consumer echoes, stores, or re-serves the decoded value, the attacker receives the disclosed data back, potentially exposing sensitive process memory such as authentication tokens and confidential application data. These affects carry a DELEGATED resolution, so fixes are being pursued through the community maintainers of the affected packages rather than by Red Hat Product Security directly, and no directly supported Red Hat products are affected. Red Hat Product Security scores this flaw CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), lower than the upstream CVEORG score of 8.6, because the out-of-bounds read remains within the vulnerable process's own address space and does not cross a security boundary.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Memory
An attacker could get secret values such as cryptographic keys, PII, memory addresses, or other information that could be used in additional attacks.
Confidentiality
Technical Impact: Bypass Protection Mechanism
Out-of-bounds memory could contain memory addresses or other information that can be used to bypass ASLR and other protection mechanisms in order to improve the reliability of exploiting a separate weakness for code execution.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
An attacker could cause a segmentation fault or crash by causing memory to be read outside of the bounds of the buffer. This is especially likely when the code reads a variable amount of data and assumes that a sentinel exists to stop the read operation, such as a NUL in a string.
Other
Technical Impact: Varies by Context
The read operation could produce other undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
