CVE-2026-88341

A flaw was found in YARA. A remote attacker could exploit this vulnerability by providing a specially crafted compiled rule file .yrc with an invalid arena configuration. This malicious file, when loaded, triggers an assertion failure, leading to the application's termination. This results in a...

CVE-2026-88340

A flaw was found in YARA. This invalid pointer release vulnerability occurs during the deserialization of compiled rule files .yrc. An attacker can exploit this by providing a specially crafted .yrc file, leading to insufficient validation of external-variable pointers. This can result in memory...

Linux Distros Unpatched Vulnerability : CVE-2026-88340

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An invalid pointer release vulnerability exists in YARA 4.5.8 during deserialization of compiled .yrc rule files. The vulnerability is caused by insufficient...

UBUNTU-CVE-2026-88340

An invalid pointer release vulnerability exists in YARA 4.5.8 during deserialization of compiled .yrc rule files. The vulnerability is caused by insufficient validation of external-variable pointers, which may lead to invalid free in yrrulesdestroy or wild pointer access in yrobjectcreate. An...

CVE-2026-88341: Reachable Assertion

A reachable assertion vulnerability exists in YARA 4.5.8 when loading crafted .yrc compiled rule files. An attacker can provide a malicious file with an invalid arena configuration numbuffers=0 that triggers an assertion failure in yrarenagetptr, causing the application to terminate...

CVE-2026-88340: Release of Invalid Pointer or Reference

An invalid pointer release vulnerability exists in YARA 4.5.8 during deserialization of compiled .yrc rule files. The vulnerability is caused by insufficient validation of external-variable pointers, which may lead to invalid free in yrrulesdestroy or wild pointer access in yrobjectcreate. An...

CVE-2026-88340

An invalid pointer release vulnerability exists in YARA 4.5.8 during deserialization of compiled .yrc rule files. The vulnerability is caused by insufficient validation of external-variable pointers, which may lead to invalid free in yrrulesdestroy or wild pointer access in yrobjectcreate. An...

PT-2026-97026

Name of the Vulnerable Software and Affected Versions YARA version 4.5.8 Description An invalid pointer release occurs during the deserialization of compiled .yrc rule files. The issue stems from insufficient validation of external-variable pointers, which can result in an invalid free within the...

CVE-2026-88341

A reachable assertion vulnerability exists in YARA 4.5.8 when loading crafted .yrc compiled rule files. An attacker can provide a malicious file with an invalid arena configuration numbuffers=0 that triggers an assertion failure in yrarenagetptr, causing the application to terminate...

CVE-2026-88341

A reachable assertion vulnerability exists in YARA 4.5.8 when loading crafted .yrc compiled rule files. An attacker can provide a malicious file with an invalid arena configuration numbuffers=0 that triggers an assertion failure in yrarenagetptr, causing the application to terminate...

EUVD-2026-84849

An invalid pointer release vulnerability exists in YARA 4.5.8 during deserialization of compiled .yrc rule files. The vulnerability is caused by insufficient validation of external-variable pointers, which may lead to invalid free in yrrulesdestroy or wild pointer access in yrobjectcreate. An...

PT-2026-97027

A reachable assertion vulnerability exists in YARA 4.5.8 when loading crafted .yrc compiled rule files. An attacker can provide a malicious file with an invalid arena configuration num buffers=0 that triggers an assertion failure in yr arena get ptr, causing the application to terminate...

CVE-2023-1868

The YourChannel plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check when clearing the plugin cache via the yrcclearcache GET parameter in versions up to, and including, 1.2.3. This makes it possible for unauthenticated attackers to clear the plugin's...

Authorization

An issue was discovered in PhreeBooksERP before 2017-02-13. The vulnerability exists due to insufficient filtration of user-supplied data in the "form" HTTP GET parameter passed to the "PhreeBooksERP-master/extensions/ShippingMethods/ups/labelmgr/jsinclude.php" and...

CVE-2017-5990

An issue was discovered in PhreeBooksERP before 2017-02-13. The vulnerability exists due to insufficient filtration of user-supplied data in the "form" HTTP GET parameter passed to the "PhreeBooksERP-master/extensions/ShippingMethods/ups/labelmgr/jsinclude.php" and...