Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-55246— bincookie: Heap buffer overflow via unvalidated `num_pages` when parsing a `.binarycookies` file

Quick assessment

Affected
Tatsh bincookie
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

bincookie 是一个仅包含头文件的 binarycookies 解析库。在 0.1.9 版本之前，bincookie.h 中的 bincookie_init_file() 函数根据实际的 .binarycookies 文件长度分配缓冲区，但盲目信任文件中控制的 num_pages 字段作为页面大小条目字节交换循环的上限。精心构造的恶意文件可使该循环读取和写入超出堆分配区域，且未经过验证的页面大小和 cookie 偏移量可能导致在页面和 cookie 迭代过程中产生额外的越界访问。解析攻击者提供的 binary

CVSS 7.8 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
Tatsh bincookie < 0.1.9 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55246

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
bincookie: Heap buffer overflow via unvalidated `num_pages` when parsing a `.binarycookies` file
Source: CVE Program / CVE List V5
Vulnerability Description
bincookie is a header-only binarycookies parser. Prior to 0.1.9, bincookie_init_file() in bincookie.h allocates a buffer using the actual .binarycookies file length but trusts the file-controlled num_pages field as the loop bound for byte-swapping page_sizes entries. A crafted file can make the loop read and write beyond the heap allocation, and related unvalidated page sizes and cookie_offsets can drive additional out-of-bounds accesses in page and cookie iteration. Applications that parse an attacker-supplied binarycookies file may crash or suffer heap corruption that can potentially enable code execution. This issue is fixed in version 0.1.9.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
堆缓冲区溢出
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Tatsh bincookie < 0.1.9 -

II. Public POCs for CVE-2026-55246

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-55246

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-55246 (1)

Vendor Advisories for CVE-2026-55246 (1)

Proof of Concept for CVE-2026-55246 (1)

IV. Related Vulnerabilities

Same weakness: CWE-122

V. Comments for CVE-2026-55246

No comments yet

Leave a comment