{"id":"CVE-2026-126050","summary":"apitrace 2.0 through 14.0 Heap Buffer Overflow via SnappyFile::flushReadCache()","details":"apitrace 2.0 through 14.0 contains a heap-based buffer overflow in SnappyFile::flushReadCache() that allows attackers to write past m_compressedCache via an oversized compressed chunk length. Attackers can supply a crafted .trace file whose 4-byte chunk length exceeds the fixed buffer size, corrupting heap memory when users dump, inspect, or replay it.","modified":"2026-11-12T07:07:26.260887946Z","published":"2026-11-10T16:58:04.990Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126050.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-122"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126050.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126050"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/apitrace-2.0-through-14.0-heap-buffer-overflow-via-snappyfile-flushreadcache"},{"type":"FIX","url":"https://github.com/apitrace/apitrace/commit/3890c5a448addfd75ccbe1bd09e3075de6fb3395"},{"type":"PACKAGE","url":"https://github.com/apitrace/apitrace"},{"type":"ARTICLE","url":"https://github.com/apitrace/apitrace/blob/18cfd388ac47a9e00978b34d6c20341f3e2cdb56/lib/trace/trace_file_snappy.cpp#L215-L235"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apitrace/apitrace","events":[{"introduced":"e2c43205033026d70c12b592c84dfcc1e667cb4b"},{"fixed":"3890c5a448addfd75ccbe1bd09e3075de6fb3395"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"2.0"},{"last_affected":"14.0"}]},{"source":"REFERENCES_COMMIT","range":[{"fixed":"3890c5a448addfd75ccbe1bd09e3075de6fb3395"}]}]}}],"versions":["14.0","13.0","12.0","11.1","11.0","10.0","9.0","8.0","7.1","7.0","6.1","6.0","5.0","4.0","3.0","2.0"],"database_specific":{"vanir_signatures_modified":"2026-11-12T07:07:26Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126050.json","vanir_signatures":[{"id":"CVE-2026-126050-7a1893b3","signature_type":"Function","signature_version":"v1","source":"https://github.com/apitrace/apitrace/commit/3890c5a448addfd75ccbe1bd09e3075de6fb3395","target":{"file":"lib/trace/trace_file_snappy.cpp","function":"SnappyFile::flushReadCache"},"deprecated":false,"digest":{"function_hash":"28547841857165329045049986667578560172","length":891}}]}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}