{"id":"CVE-2026-107161","published":"2026-10-07T20:17:10.977","lastModified":"2026-10-10T03:17:05.307","description":"A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-122"],"vendors":[],"products":[],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-107161","tags":[]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2460420","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/09/20","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A heap-based buffer overflow exists in Cyrus SASL's DIGEST-MD5 plugin where improperly calculated buffer sizes during challenge field processing can lead to out-of-bounds writes when special characters are escaped, potentially allowing remote code execution or application crashes.","exploitability":"Exploitation requires a malicious server to send crafted challenge fields that trigger the overflow, with minimal preconditions beyond network access to a vulnerable client.","blast_radius":"The flaw could affect any application using Cyrus SASL for DIGEST-MD5 authentication, particularly email clients and web applications, potentially causing widespread service disruptions through crashes.","remediation":"Upgrade to Cyrus SASL version 2.600 or later which contains the fix for this buffer overflow vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth","buffer-overflow","sasl","remote"],"model":"garnet-coder","analyzedAt":"2026-10-15T09:02:40.952Z"}}