PT-2026-65065 · Facil.Io · Facil.Io

Theodosis Paidakis · CVE-2026-66729 · Published 2026-07-27 · Updated 2026-07-27

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions facil.io versions 0.6.0 through 0.7.6

Description An integer underflow exists in the multipart MIME body parser. Unauthenticated remote attackers can crash the server process by sending a crafted Content-Disposition header with an empty field name. This triggers a uint32 t wraparound in http mime parser.h, leading to an out-of-bounds memory read past the name pointer, which results in a bus fault that crashes the handling worker via a single POST request.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-66729

Affected Products

Facil.Io

References · 3

• 🔥 https://github.com/theopaid/Out-of-Bounds-Read-in-facil.io-MIME-Parser-leads-to-Server-Crash · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-66729 · Security Note
• https://vulncheck.com/advisories/facil-io-integer-underflow-dos-via-multipart-mime-body-parser · Note