CVE-2026-88340

An invalid pointer release vulnerability exists in YARA 4.5.8 during deserialization of compiled .yrc rule files. The vulnerability is caused by insufficient validation of external-variable pointers, which may lead to invalid free in yrrulesdestroy or wild pointer access in yrobjectcreate. An...

CVE-2026-88340

The software YARA version 4.5.8 is vulnerable to an invalid pointer release vulnerability during the deserialization of compiled .yrc rule files . The root cause is the insufficient validation of external-variable pointers , which can lead to an invalid free in yr_rules_destroy() or wild pointer ...