CVE-2026-95124
Description
A flaw was found in libconfini. A buffer overflow vulnerability allows a remote attacker to cause a Denial of Service (DoS) condition. This issue occurs due to an allocation-size mismatch between the load_ini_buffer utility and the strip_ini_cache function, leading to memory corruption that crashes the application.
Statement
Red Hat rates this vulnerability as Moderate severity because exploitation requires an application or user to parse a specially crafted configuration file, limiting the blast radius to a denial of service of the consuming process. Because the failure results strictly in an application crash without compromising system confidentiality or data integrity, higher severity ratings are not applicable. Exposure across standard Red Hat enterprise environments is minimal as the affected library is not shipped by default.
Understanding the Weakness (CWE)
Integrity,Availability,Confidentiality
Technical Impact: DoS: Crash, Exit, or Restart; Execute Unauthorized Code or Commands; Read Memory; Modify Memory
If the incorrect calculation is used in the context of memory allocation, then the software may create a buffer that is smaller or larger than expected. If the allocated buffer is smaller than expected, this could lead to an out-of-bounds read or write (CWE-119), possibly causing a crash, allowing arbitrary code execution, or exposing sensitive data.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
