CVE-2026-88341
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
A reachable assertion vulnerability exists in YARA 4.5.8 when loading crafted .yrc compiled rule files. An attacker can provide a malicious file with an invalid arena configuration (num_buffers=0) that triggers an assertion failure in yr_arena_get_ptr(), causing the application to terminate.
Risk Assessment
An attacker can remotely crash an application using YARA, causing a denial of service (DoS). This may disrupt file analysis systems or security scanners based on YARA.
Recommendation
Update YARA to a version newer than 4.5.8 as soon as a fix is available. Until then, avoid loading .yrc files from untrusted sources.
Other vulnerabilities in YARA
See all- CVE-2017-9465High
The yr_arena_write_data function in YARA 3.6.1 allows remote attackers to cause a denial of service (buffer over-read and application crash) or obtain sensitive information from process memory via a crafted file mishandled in the yr_re_fast_exec and _yr_scan_match_callback functions.
- CVE-2017-9438High
The regexp module in YARA 3.5.0 contains a vulnerability that allows remote attackers to cause a denial of service (stack consumption) via a crafted rule involving hex strings, mishandled in the _yr_re_emit function.
- CVE-2017-9304High
The regexp module in YARA 3.5.0 contains a vulnerability that allows remote attackers to cause a denial of service (stack consumption) via a crafted rule mishandled in the _yr_re_emit function.
- CVE-2017-8929High
The sized_string_cmp function in libyara/sizedstr.c in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted rule.
- CVE-2017-8294High
The regex component in YARA 3.5.0 has a vulnerability that allows remote attackers to cause a denial of service through a crafted rule, leading to out-of-bounds read and application crash.
- CVE-2017-5924High
YARA 3.5.0 has a vulnerability that allows remote attackers to cause a denial of service through a crafted rule mishandled in the yr_compiler_destroy function, leading to a use-after-free error and application crash.
- CVE-2017-5923High
YARA 3.5.0 has a vulnerability that allows remote attackers to cause a denial of service through a crafted rule, leading to a heap-based out-of-bounds read and application crash.
- CVE-2016-10211High
YARA 3.5.0 has a vulnerability that allows remote attackers to cause a denial of service through a crafted rule mishandled in the yr_parser_lookup_loop_variable function, leading to a use-after-free error and application crash.
- CVE-2016-10210High
In YARA 3.5.0, a vulnerability allows remote attackers to cause application crashes via a crafted rule, leading to a NULL pointer dereference in the yy_get_next_buffer function.
- CVE-2026-88340High
An invalid pointer release vulnerability exists in YARA 4.5.8 during deserialization of compiled .yrc rule files. The vulnerability is caused by insufficient validation of external-variable pointers, which may lead to invalid free in yr_rules_destroy() or wild pointer access in yr_object_create(). An attacker can provide a specially crafted .yrc file that causes memory corruption and application crash.
Original NVD description (English source)
A reachable assertion vulnerability exists in YARA 4.5.8 when loading crafted .yrc compiled rule files. An attacker can provide a malicious file with an invalid arena configuration (num_buffers=0) that triggers an assertion failure in yr_arena_get_ptr(), causing the application to terminate.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS