GHSA-2jx3-ff3v-j7jj: yara-x: Unvalidated deserialization in safe `Rules::deserialize` allows memory corruption and UB
Summary
The yara-x library has a vulnerability in its `Rules::deserialize` function, which accepts untrusted data and reconstructs internal lookup tables without validating them. When malformed serialized bytes are passed in, subsequent safe operations like scanning can trigger out-of-bounds memory reads (undefined behavior, unpredictable crashes or memory corruption) because the code uses unsafe operations that assume the internal structures are valid. This means an attacker could craft a malicious serialized rules file to crash or corrupt a program using this library.
Classification
Affected Vendors
Affected Packages
Related Issues
CVE-2026-63086: text-generation-inference through 3.3.7 contains a server-side request forgery (SSRF) vulnerability in the OpenAI-compat
CVE-2026-34371: LibreChat is a ChatGPT clone with additional features. Prior to 0.8.4, LibreChat trusts the name field returned by the e
Original source: https://github.com/advisories/GHSA-2jx3-ff3v-j7jj
First tracked: September 24, 2026 at 08:01 PM
Classified by LLM (prompt v3) · confidence: 85%