CVE-2026-63384
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in event_tagging.c when evtag_unmarshal_header uses evtag_decode_int to decode an attacker-controlled uint32 payload length and returns it as a signed int. Values above INT_MAX become negative or truncated, and evtag_unmarshal_string can use the converted value in allocation sizing, producing a wrapped large allocation request and denial of service. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.
CSIRTS triage
- What
- evtag_unmarshal_header() decodes a wire uint32 length into a signed int return value, causing type confusion.
- Who is affected
- Libevent applications processing network data with tag unmarshaling.
- Urgency
- Moderate; type confusion may cause integer overflow or buffer handling errors; patch when available.
- Action
- Update Libevent to a version with correct signed/unsigned handling in tag unmarshaling.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-63384
Get an email if CVE-2026-63384 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.38% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 32% of all EPSS-scored CVEs.
Advisory coverage (2)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-63384)