CVE-2026-88341Medium· 5.5▾ TwilightPoC availableA reachable assertion vulnerability exists in YARA 4.5.8 when loading crafted .yrc compiled rule files. An attacker can provide a malicious file with an invalid arena configuration (num_buffers=0) that triggers an assertion failure in yr…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 30.3 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 23.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Exploit / PoC code exists
— → 5.5
none → medium
Last analysed / modified upstream
A reachable assertion vulnerability exists in YARA 4.5.8 when loading crafted .yrc compiled rule files. An attacker can provide a malicious file with an invalid arena configuration (num_buffers=0) that triggers an assertion failure in yr_arena_get_ptr(), causing the application to terminate.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-109240Low· 3.1FreeRDP 3.11.0 before 3.32.1 contains a reachable assertion vulnerability in urb_isoch_transfer that allows malicious RDP servers to crash clients by sending unvalidated OutputBufferSize values
CVE-2026-101612Medium· 4.0mysql: mysql: Denial of Service in InnoDB component (CVE-2026-101612)
CVE-2026-101618Medium· 4.9mysql: mysql: Denial of Service in InnoDB (CVE-2026-101618)
CVE-2026-101619Medium· 4.9mysql: mysql: Denial of Service in InnoDB (CVE-2026-101619)
CVE-2026-101621Medium· 4.9mysql: mysql: Denial of Service in InnoDB (CVE-2026-101621)
CVE-2026-101727Medium· 4.9mysql: mysql: Denial of Service via the Replication component (CVE-2026-101727)