PT-2026-25869 · Libucl · Libucl

Zakkanijia · Published 2026-03-17 · Updated 2026-05-11 · CVE-2026-0708

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H

Name of the Vulnerable Software and Affected Versions libucl (affected versions not specified)

Description A flaw exists in libucl where a remote attacker can cause a Denial of Service (DoS) by providing a specially crafted Universal Configuration Language (UCL) input. This input contains a key with an embedded null byte, which triggers a segmentation fault (SEGV fault) within the ucl object emit function during parsing and emission of the object. A segmentation fault is a type of error that occurs when a program attempts to access a memory location that it is not allowed to access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-0708

Affected Products

Libucl

References · 9

• 🔥 https://github.com/vstakhov/libucl/issues/323 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-0708 · Security Note
• https://access.redhat.com/security/cve/CVE-2026-0708 · Note
• https://twitter.com/TheHackerWire/status/2034030868814303582 · Twitter Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2427770 · Note
• https://t.me/cveNotify/155581 · Telegram Post
• https://twitter.com/CVEnew/status/2033755307344601381 · Twitter Post
• https://t.me/cveNotify/163063 · Telegram Post
• https://twitter.com/CVEarity/status/2033799723371663544 · Twitter Post