CVE-2026-112063 Details

A stack-based buffer overflow vulnerability has been identified in libstrophe versions through 0.14.0. This vulnerability resides in the SCRAM_Hi function, where an oversized SCRAM salt sent by malicious XMPP servers can overflow a 128-byte stack buffer. The issue arises because the library decodes the salt without proper length validation, allowing attackers to overwrite stack memory or cause a denial-of-service by crashing the client. In NDEBUG builds, the overflow is unguarded and can be exploited, while the default autotools build includes an assert that prevents the overflow but causes the client to abort, creating a remote denial-of-service condition.

To address this vulnerability, libstrophe should implement proper length checks on the SCRAM salt before processing it. The SCRAM_Hi function can be modified to reject oversized salts at runtime, ensuring that the buffer overflow cannot occur. Additionally, the iteration count in the SCRAM protocol should be capped at a reasonable limit to prevent excessive resource consumption.