CVE-2026-77755

The CVSS 8.7 score for CVE-2026-77755 obscures what's actually a more serious structural failure: a library that was terminating the processes that called it. The MISP-STIX parser was using sys.exit() inside parsing code — a well-documented Python anti-pattern that bypasses bare except Exception clauses. When you wrapped STIX import logic in defensive exception handling and a malformed document arrived, you thought you had protection. You didn't. The library was ending your process rather than raising an error you could catch, log, and recover from. This isn't merely a parsing bug. It's a caller contract violation: a library that behaved as if it owned the entire Python process, not as a component being invoked by external code. The implications for automated threat intelligence workflows are severe. When the importer process dies silently, there's no exception, no log entry, no alert — the workflow simply stops processing that feed. Your detection rules go stale. Your SOC wonders why the ISAC feed stopped updating. The failure is invisible because the process never reported it. The memory exhaustion vector compounds this. Before any type validation, STIX documents were materialized in memory at 2-7x their input size during XML deserialization. A 50MB document could consume 350MB RAM before the parser even began checking validity. The 100MB size limit fix addresses this, but it arrived only because someone modeled the complete attack surface — which raises the uncomfortable question of what else in this library's error handling assumes it owns the process. Check your deployments now. Verify that any STIX import code catches STIXLoadingError and MissingSTIXContentError explicitly rather than relying on generic exception handlers. Confirm memory limits are enforced at your ingestion layer. If you're using legacy import modes, STIX v1 support, or older API surfaces, audit them separately — the fix may not have reached deprecated code paths that share the same flawed assumptions. The patch closes this specific vulnerability, but the class of errors (library code that terminates callers instead of raising exceptions) will surface again in other components until the industry treats integration testing with simulated adversarial callers as routine, not optional.

Reviewed through automated stages and approved by a human before publication.