CVE-2026-39457

High

Published: 30/04/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The vulnerability in libnv involves a lack of verification whether the provided socket descriptor fits within the FD_SETSIZE (1024) limit during data exchange over a socket. An attacker can force a libnv application to allocate large file descriptors, potentially leading to stack corruption.

Risk Assessment

If the vulnerable application is setuid-root, an attacker could exploit this vulnerability to elevate local privileges, posing a significant security risk to the system.

Recommendation

It is recommended to implement verification of socket descriptors in applications using libnv to ensure they do not exceed the FD_SETSIZE limit. Additionally, avoid running applications with setuid-root privileges unless absolutely necessary.

Other vulnerabilities in libnv

CVE-2026-35547High
When processing the header of an incoming message, libnv failed to properly validate the message size. The lack of validation allows a malicious program to write outside the bounds of a heap allocation, which can trigger a crash or system panic.

Original NVD description (English source)

When exchanging data over a socket, libnv uses select(2) to wait for data to arrive. However, it does not verify whether the provided socket descriptor fits in select(2)'s file descriptor set size limit of FD_SETSIZE (1024). An attacker who is able to force a libnv application to allocate large file descriptors, e.g., by opening many descriptors and executing a program which is not careful to close them upon startup, can trigger stack corruption. If the target application is setuid-root, then this could be used to elevate local privileges.