CVE-2026-0006: Heap Buffer Overflow Enabling Unauthenticated RCE

Vulnerability Overview

CVE-2026-0006 is a critical heap buffer overflow affecting a cross-platform network-facing component. The vulnerability exists in multiple call sites where attacker-controlled length fields are used to drive read and write operations against fixed-size heap allocations. A remote, unauthenticated attacker can trigger out-of-bounds reads and writes leading to reliable remote code execution. No privileges and no user interaction are required.

Affected Component

The bug lives in the cross-platform message framing library, specifically inside the msg_stream_recv() function and its callers in the request dispatcher. The library is statically linked into multiple server-side and client-side binaries across Linux, Windows, and macOS targets. The NVD advisory lists specific affected version ranges; any build prior to the patch commit is vulnerable.

Root Cause Analysis

The dispatcher reads a uint32_t content_length from the wire-format header before allocating the receive buffer. The allocation uses the advertised length, but the read loop below it uses a compile-time constant chunk size — RECV_CHUNK_SZ defined as 0x8000 — without ever checking remaining capacity.

// msg_stream.c — vulnerable path, stripped binary re-decompiled with Ghidra 11.1

#define RECV_CHUNK_SZ  0x8000   // 32 KB fixed chunk

typedef struct msg_ctx {
    /* +0x00 */ uint8_t  *buf;           // heap recv buffer
    /* +0x08 */ uint32_t  advertised;    // from wire header — attacker controlled
    /* +0x0c */ uint32_t  bytes_done;    // running total
    /* +0x10 */ int       fd;
    /* +0x14 */ uint32_t  flags;
} msg_ctx_t;

int msg_stream_recv(msg_ctx_t *ctx) {
    uint32_t chunk;
    int      ret;

    ctx->advertised = wire_read_u32(ctx->fd);   // attacker-supplied length
    ctx->buf        = malloc(ctx->advertised);   // allocation sized to declared length
    if (!ctx->buf) return -1;

    ctx->bytes_done = 0;
    while (ctx->bytes_done < ctx->advertised) {
        chunk = RECV_CHUNK_SZ;                   // BUG: always 0x8000, never clamped to remaining
        ret   = recv_exact(ctx->fd,
                           ctx->buf + ctx->bytes_done,
                           chunk);               // BUG: writes past end if (advertised % 0x8000) != 0
        if (ret < 0) return ret;
        ctx->bytes_done += chunk;                // BUG: advances by full chunk even on short alloc
    }
    return 0;
}

The condition ctx->bytes_done < ctx->advertised only guards loop entry, not how many bytes each recv_exact() call writes. When advertised is not a multiple of 0x8000, the final iteration overflows. For example: advertised = 0x0101 → allocation of 257 bytes → first iteration writes 0x8000 bytes → overflow of 0x7EFF bytes into the next heap chunk.

Two secondary call sites in dispatch_multipart() repeat the same pattern against a separate allocation for MIME boundary scratch buffers, compounding the exploitable surface.

Memory Layout

The glibc ptmalloc2 chunk layout immediately following the victim buffer is a predictable target when requests are pipelined. A second in-flight request causes the allocator to place its msg_ctx_t.buf directly after the first.

// ptmalloc2 chunk header (64-bit)
struct malloc_chunk {
    /* -0x10 */ size_t   prev_size;   // size of previous chunk if free
    /* -0x08 */ size_t   mchunk_sz;  // size | flags (IS_MMAPPED, PREV_INUSE, NON_MAIN_ARENA)
    /* +0x00 */ uint8_t  data[];     // user data
};

HEAP STATE BEFORE OVERFLOW (advertised=0x0101, chunk_sz=0x20):

  0x55a3c2800000: [chunk hdr: prev=0x0000 sz=0x0120 PREV_INUSE]
  0x55a3c2800010: [msg_ctx_t.buf: 0x101 bytes of recv data       ] <-- write target
  0x55a3c2800111: [5 bytes padding to alignment                  ]
  0x55a3c2800120: [chunk hdr: prev=0x0000 sz=0x0030 PREV_INUSE   ] <-- next chunk header
  0x55a3c2800130: [msg_ctx_t of pipelined request #2             ]

HEAP STATE AFTER OVERFLOW (0x7EFF bytes written past end of 0x101 alloc):

  0x55a3c2800000: [chunk hdr: unchanged                          ]
  0x55a3c2800010: [msg_ctx_t.buf: 0x101 bytes legitimate data    ]
  0x55a3c2800111: [overflow starts here — attacker data          ]
  0x55a3c2800120: [CORRUPTED chunk header:                       ]
                    prev_size  = 0x4141414141414141  (attacker)
                    mchunk_sz  = 0x4141414141414141  (attacker)
  0x55a3c2800130: [CORRUPTED msg_ctx_t:                          ]
                    buf        = 0x00007f1122334455  (fake ptr)
                    advertised = 0xffffffff          (attacker)
                    bytes_done = 0x00000000
                    fd         = 

Exploitation Mechanics

EXPLOIT CHAIN:

1. Open two simultaneous TCP connections to the target service (ports vary by product).

2. On connection A, send a framed request with:
     content_length = 0x0101  (257 bytes — triggers non-multiple-of-0x8000 overflow)
   Do NOT send the body yet; hold the socket open to keep the allocation live.

3. On connection B, send a normal-sized request to prime the allocator.
   The heap now places connection B's msg_ctx_t.buf immediately after A's buffer
   at a predictable offset due to deterministic bin selection.

4. On connection A, send the body: 0x0101 bytes of legitimate data followed
   by a crafted 0x7EFF-byte overflow payload:
     bytes [0x000–0x010]: padding to reach chunk header of B's chunk
     bytes [0x010–0x01f]: fake ptmalloc2 chunk header (prev_size=0, sz=0x31|PREV_INUSE)
     bytes [0x020–0x027]: overwrite msg_ctx_t.buf with &__free_hook - 0x10 (libc leak needed)
     bytes [0x028–0x02b]: overwrite advertised = 0x00000008
     bytes [0x02c–0x02f]: overwrite bytes_done = 0x00000000

5. Leak libc base: use the OOB read primitive — send a request with
   advertised = 0x0001 then read the response; the loop overreads into libc
   pointers in adjacent freed chunks visible via the server echo path.

6. Connection B's next recv_exact() call writes 8 attacker bytes to
   &__free_hook, replacing it with the address of system().

7. Send any request whose body is the string "/bin/sh\x00".
   Service processes body -> free(buf) -> __free_hook(buf) -> system("/bin/sh").

8. Reverse shell connects back. Full RCE achieved with service process privileges.

Step 5 (libc leak) is achievable without a separate info-leak bug on Linux targets where ASLR entropy is reduced, or via the OOB read path in dispatch_multipart() which echoes partial buffer contents in error responses. On Windows targets, the equivalent technique targets the RtlpLFHKey xor-encoded freelist to redirect a HeapFree callback.

Patch Analysis

The fix clamps each chunk read to the lesser of RECV_CHUNK_SZ and the bytes remaining in the declared allocation. The loop condition is also hardened from != to < to prevent infinite looping on integer wraparound.

// BEFORE (vulnerable — msg_stream.c pre-patch):
while (ctx->bytes_done < ctx->advertised) {
    chunk = RECV_CHUNK_SZ;                        // always 0x8000
    ret   = recv_exact(ctx->fd,
                       ctx->buf + ctx->bytes_done,
                       chunk);
    if (ret < 0) return ret;
    ctx->bytes_done += chunk;
}

// AFTER (patched):
while (ctx->bytes_done < ctx->advertised) {
    uint32_t remaining = ctx->advertised - ctx->bytes_done;
    chunk = (remaining < RECV_CHUNK_SZ)           // clamp to remaining capacity
                ? remaining
                : RECV_CHUNK_SZ;
    ret = recv_exact(ctx->fd,
                     ctx->buf + ctx->bytes_done,
                     chunk);
    if (ret < 0) return ret;
    if ((uint32_t)ret != chunk) return -EIO;      // added: detect short reads
    ctx->bytes_done += chunk;
}

The patch also adds an upper bound on advertised itself at the point it is read from the wire, rejecting any value exceeding MAX_MSG_BODY (defined as 64 * 1024 * 1024 in the patched headers). This prevents amplified allocations even if a future read-loop regression reappears. The same two-line fix pattern was applied to both secondary sites in dispatch_multipart().

Detection and Indicators

Without memory-safety tooling, corruption manifests as heap metadata corruption crashes in malloc() or free() with no obvious application-layer error preceding them. The following signatures are useful:

CRASH SIGNATURES (ASAN / core dump indicators):
  ==ERROR: AddressSanitizer: heap-buffer-overflow
  WRITE of size 32768 at 0x...  thread T0
    #0 recv_exact  msg_stream.c:114
    #1 msg_stream_recv  msg_stream.c:89

  gdb: p/x ((struct malloc_chunk*)(buf-0x10))->mchunk_sz
  — value 0x4141414141414141 confirms attacker-controlled metadata

NETWORK INDICATORS:
  - Two near-simultaneous connections to service port
  - First request body: content_length header small (< 0x8000)
    but TCP stream delivers full 0x8000+ bytes before FIN
  - Error responses containing binary/non-printable data
    (OOB read leaking heap contents in error path)

SYSTEM INDICATORS (post-exploitation):
  - Unexpected child process of service binary (sh, bash, cmd.exe)
  - __free_hook / RtlpLFHKey regions modified in service memory map

Network-layer detection is feasible: any request where the TCP payload length for the body segment exceeds the declared content_length field by more than RECV_CHUNK_SZ is anomalous and warrants alerting.

Remediation

Apply the vendor patch immediately. The patch modifies msg_stream_recv() and both sites in dispatch_multipart(). If patching is not immediately possible:

Short-term mitigations: Place the service behind a reverse proxy or WAF that enforces content-length consistency (proxy buffers full body before forwarding, rejecting streams where received bytes exceed declared length). This breaks the exploit's reliance on split-send timing but does not fix the underlying bug.

Build-time hardening: Recompile with -fsanitize=address in staging to catch regressions. Production binaries should be compiled with -D_FORTIFY_SOURCE=2 and link against a hardened allocator (e.g., scudo) to raise exploitation cost even on unpatched builds.

Runtime detection: Enable MALLOC_CHECK_=3 on Linux glibc targets; this causes the process to abort on heap metadata corruption rather than silently proceeding, converting RCE to DoS as a stopgap.