CVE-2026-63381

CVE-2026-63381 is a use-after-free in libevent's evbuffer_add_buffer_reference function that triggers when the target buffer has zero length. The vulnerability lives in a narrow code path: evbuffer_add_buffer_reference, when invoked on an output buffer with out_total_len of zero, calls evbuffer_free_all_chains to deallocate the buffer's internal chain structure. The function then attempts to append chains from the source buffer via APPEND_CHAIN_MULTICAST — but evbuffer_free_all_chains leaves three pointers (first, last, and last_with_datap) in an undefined state rather than NULLing them. The subsequent dereference of these dangling pointers causes memory corruption and likely a crash. The root cause is straightforward at the code level: three missing NULL assignments after the free. The fix adds exactly those three lines. However, the practical impact is amplified by libevent's role as foundational infrastructure. This library underpins Tor, Chromium's network stack, BIND, and other long-running processes where a crash isn't just a local failure — it's a systemic availability event across interconnected services. The CVSS score of 5.8 reflects the technical exploit difficulty (the zero-length precondition is required), but it understates the operational blast radius for anything depending on libevent's event loop. Check your deployments now. Any code path that could invoke evbuffer_add_buffer_reference on a zero-length buffer — whether through legitimate usage or caller-side bugs — is vulnerable. The library provides no defensive guard; the function returns no error, produces no warning, and corrupts memory silently before the crash. If you're maintaining software that links libevent, audit call sites for this function and validate that target buffers are never zero-length at invocation. Consider adding runtime assertions in wrapper code until a patched version is available. The broader lesson is that MEM52-C violations (post-free NULLification) cluster in chain-based buffer code where multiple pointers reference the same allocation. Libevent has had this pattern before. When patching, audit other evbuffer functions that perform chain manipulation for the same gap — the data structure design itself creates conditions where this class of bug recurs.

Reviewed through automated stages and approved by a human before publication.