CVE-2026-95124 Details

A buffer overflow vulnerability has been identified in madmurphy libconfini version 1.16.4. This vulnerability allows remote attackers to cause a denial-of-service by exploiting an allocation-size mismatch between the library's bundled load_ini_buffer utility and the strip_ini_cache function. The issue arises because load_ini_buffer allocates a buffer of exactly ini_length bytes, while strip_ini_cache writes a null terminator to ini_source[ini_length], creating a one-byte heap out-of-bounds write. This out-of-bounds write leads to heap memory corruption.

Users are advised to update the load_ini_buffer utility to allocate ini_length + 1 bytes to accommodate the null terminator. This change has been made in the official repository.