CVE-2016-9036CWE-125

An exploitable incorrect return value vulnerability exists in the mp_check function of Tarantool's Msgpuck library 1.0.3

High · published December 23, 2016

CVSS v3.0
7.5
EPSS
3%
Percentile
86.4
In the wild
Unconfirmed
What it is

An exploitable incorrect return value vulnerability exists in the mp_check function of Tarantool's Msgpuck library 1.0.3. A specially crafted packet can cause the mp_check function to incorrectly return success when trying to check if decoding a map16 packet will read outside the bounds of a buffer, resulting in a denial of service vulnerability.

The record
Technical detail
CVSS v3.0
7.5 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.02825 · 86.4th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2016-12-23T22:00Z
EPSS history
Timeline
  • 23 DEC 22:00Z
    An exploitable incorrect return value vulnerability exists in the mp_check function of Tarantool's Msgpuck library 1.0.3
    cvelistv5