CVE-2026-88341

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-88341
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-88341.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-88341
Downstream
Published
2026-09-22T00:00:00Z
Modified
2026-09-24T08:34:23Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

A reachable assertion vulnerability exists in YARA 4.5.8 when loading crafted .yrc compiled rule files. An attacker can provide a malicious file with an invalid arena configuration (num_buffers=0) that triggers an assertion failure in yr_arena_get_ptr(), causing the application to terminate.

Database specific 
{
    "cna_assigner":  "mitre",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88341.json"
}
References

Affected packages

Git / github.com/nouiy/yara

Affected ranges

Type
GIT
Repo
https://github.com/nouiy/yara
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0cdff36723cd260243bb2b330bda555693354760
Database specific
Show details 
{
    "source":  "REFERENCES"
}

Affected versions

v2.*
v2.0.0
v2.1.0
v3.*
v3.0.0
v3.1.0
v3.10.0
v3.10.0-rc1
v3.11.0
v3.2.0
v3.3.0
v3.4.0
v3.6.0
v3.7.0
v3.8.0
v3.8.1
v3.9.0
v4.*
v4.0.0
v4.0.0-rc1
v4.0.0-rc2
v4.0.0-rc3
v4.0.1
v4.0.2
v4.1.0
v4.1.0-rc1
v4.1.0-rc2
v4.2.0-rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-88341.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "147080673429939219645922347022940208548",
            "length":  2298
        },
        "id":  "CVE-2026-88341-12b94c51",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/nouiy/yara/commit/0cdff36723cd260243bb2b330bda555693354760",
        "target":  {
            "file":  "libyara/rules.c",
            "function":  "yr_rules_from_arena"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "189504193095206950262727162923820541108",
            "length":  286
        },
        "id":  "CVE-2026-88341-1795ae81",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/nouiy/yara/commit/0cdff36723cd260243bb2b330bda555693354760",
        "target":  {
            "file":  "libyara/arena.c",
            "function":  "yr_arena_create"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "283668930824124978549320210117056182792",
                "312373744132288653370882944776961562106",
                "249788318459859082519474174088646478950",
                "255705816340012331033252862404449256582",
                "46531724251629951041180134400165386340",
                "291858979631150708373640441544227427810",
                "252187744915566439425826966378073335908",
                "134400636869565240781722501329584403116",
                "27670394423976955711009930529193015669",
                "112820134014274317308370183110785163336",
                "328343638702355872496183329084716042105",
                "323630042962307566701214077279250878506",
                "142354273131013786964844556743654081985"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-88341-1c6166f5",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/nouiy/yara/commit/0cdff36723cd260243bb2b330bda555693354760",
        "target":  {
            "file":  "libyara/arena.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "2785985885980346916776698620138192965",
            "length":  2074
        },
        "id":  "CVE-2026-88341-217173a5",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/nouiy/yara/commit/0cdff36723cd260243bb2b330bda555693354760",
        "target":  {
            "file":  "libyara/arena.c",
            "function":  "yr_arena_load_stream"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "24076747728134245935781949766096942273",
            "length":  1382
        },
        "id":  "CVE-2026-88341-54713c16",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/nouiy/yara/commit/0cdff36723cd260243bb2b330bda555693354760",
        "target":  {
            "file":  "libyara/arena.c",
            "function":  "_yr_arena_allocate_memory"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "15732717597820977666187888738616830655",
            "length":  491
        },
        "id":  "CVE-2026-88341-57ce74b3",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/nouiy/yara/commit/0cdff36723cd260243bb2b330bda555693354760",
        "target":  {
            "file":  "tests/test-arena.c",
            "function":  "basic_tests"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "77686822062761075785742939669627969765",
            "length":  563
        },
        "id":  "CVE-2026-88341-63b0cde8",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/nouiy/yara/commit/0cdff36723cd260243bb2b330bda555693354760",
        "target":  {
            "file":  "tests/test-api.c",
            "function":  "main"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "6317148431151962995450116927845587332",
                "7643455717895304348178666732778107573",
                "104383526727691746098512231188411862002",
                "181564039765494783132046888073851306890",
                "247163671425652327001934633937308930981",
                "168422503232956552690122653651645738737",
                "238254390327029510138267590865086341168",
                "211061049590470479722220674852477889865",
                "90879523020239907628902136347108264350",
                "231415724155957244009625965895078115003",
                "173849324585670528390556121747035243102",
                "339557156699738758995082180976006517923"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-88341-6d55f45a",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/nouiy/yara/commit/0cdff36723cd260243bb2b330bda555693354760",
        "target":  {
            "file":  "tests/test-arena.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "287742923009927669658388825569995779966",
                "324561450369728198343248923542931205236",
                "112831125286531062748917229769019318193",
                "297830578054037451547738915238420281255"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-88341-b79f71dc",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/nouiy/yara/commit/0cdff36723cd260243bb2b330bda555693354760",
        "target":  {
            "file":  "libyara/rules.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "302807564230693093811860274257115697650",
            "length":  338
        },
        "id":  "CVE-2026-88341-d6082ef7",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/nouiy/yara/commit/0cdff36723cd260243bb2b330bda555693354760",
        "target":  {
            "file":  "tests/test-arena.c",
            "function":  "main"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "192508560771567001387967892422664907400",
                "291044315860683660927881118446278973689",
                "97434495699494421531466175219804936921",
                "323821901923328451216702537261669144486",
                "126519672618318385395151266755493228411",
                "20533726666594437411669850912390708086",
                "24283200889195539189546434596824069740"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-88341-f97dc2f3",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/nouiy/yara/commit/0cdff36723cd260243bb2b330bda555693354760",
        "target":  {
            "file":  "tests/test-api.c"
        }
    }
]
vanir_signatures_modified 
"2026-09-24T08:34:23Z"