CVE-2026-126050 apitrace 2.0 through 14.0 Heap Buffer Overflow via SnappyFile::flushReadCache()
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-126050?
CVE-2026-126050 is a high-severity vulnerability in apitrace, published on 10 Nov 2026.
Official description
apitrace 2.0 through 14.0 contains a heap-based buffer overflow in SnappyFile::flushReadCache() that allows attackers to write past m_compressedCache via an oversized compressed chunk length. Attackers can supply a crafted .trace file whose 4-byte chunk length exceeds the fixed buffer size, corrupting heap memory when users dump, inspect, or replay it.
Weakness: CWE-122
Which versions are affected by CVE-2026-126050?
How do I fix CVE-2026-126050?
No fix has been published for CVE-2026-126050 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-126050 being exploited?
There is no known exploitation of CVE-2026-126050 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-126050, GHSA-j4j9-82qf-ghhc, UBUNTU-CVE-2026-126050.