CVE-2026-102521

HighCVSS 8.6

Published: 29/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 29/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

16th percentile - higher than 16% of all known CVEs

Summary

The decoder in `readFromDataView` in lib0 before 0.2.119 can be tricked into reading more than it should from a buffer. The vulnerability allows reading past the decoder's view, thus exposing adjacent process memory, which can contain credentials or logs.

Risk Assessment

An attacker could access sensitive data residing in process memory, including credentials or logs, potentially leading to further system compromise.

Recommendation

Update lib0 to version 0.2.119 or later to eliminate the out-of-bounds read vulnerability.

Other vulnerabilities in lib0

CVE-2026-102360High
A missing bounds check in the binary decoder in lib0, versions 0.2.1-0.2.117 and earlier and 1.0.0-rc.32 and earlier, lets any unauthenticated remote peer read adjacent process memory and receive it back. `readUint8Array` never compares the wire-supplied length against the decoder's own view, so one over-long length prefix returns whatever the host process allocated next: other tenants' document content, personal data, and live bearer session tokens.

Original NVD description (English source)

The decoder in `readFromDataView` in lib0 before 0.2.119 can be tricked into reading more than it should from a buffer. The vulnerability allows reading past the decoders' view, thus exposing adjacent process memory. This can be anything that is currently in the head, for example credentials or logs. This is similar to but different from GHSA-r5c8-rf4w-qrq8.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS