CVE-2026-88370 Details

A heap out-of-bounds write vulnerability has been identified in libconfini version 1.16.4. The issue arises in the strip_ini_cache() function, which writes a NUL terminator at a specific position without proper bounds checking. This flaw creates a condition where the function can overwrite memory outside the allocated buffer, leading to heap memory corruption. The vulnerability is triggered by the official example utility load_ini_buffer.h, which allocates an insufficient buffer size for INI data. As a result, applications processing non-empty INI input can experience deterministic heap corruption, causing a denial-of-service condition.

Users are advised to correct the buffer allocation in the load_ini_buffer utility to allocate ini_length + 1 bytes, and to add a length sanity check in the strip_ini_cache function before writing the NUL terminator.