CVE-2026-56123 socat 1.8.0.0 - 1.8.1.1 Heap Buffer Overflow via SOCKS5 Reply Parser

What is CVE-2026-56123?

CVE-2026-56123 is a critical memory corruption vulnerability in socat, published on 25 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

socat versions 1.8.0.0 through 1.8.1.1 contain a heap-based buffer overflow vulnerability that allows a malicious SOCKS5 proxy server to overwrite adjacent heap memory by exploiting a sign-extension flaw in the DOMAINNAME reply parser. During connection setup, the domain name length byte is read through a signed char field causing a negative bytes_to_read value that is implicitly converted to size_t, resulting in an unbounded heap write into the 262-byte reply buffer with attacker-controlled size and content.

Weakness: CWE-122

Which versions are affected by CVE-2026-56123?

It affects 1 product.

Products include Dest-Unreach Socat.

How do I fix CVE-2026-56123?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-56123 being exploited?

There is no known exploitation of CVE-2026-56123 in the wild and no public exploit code.

Other vulnerabilities in socat

• CVE-2015-1379 Denial of service in n/a High 7.5
• CVE-2010-2799 Memory corruption in n/a Medium 6.8
• CVE-2012-0219 Memory corruption in n/a Medium 6.2
• CVE-2016-2217 Weak cryptography in n/a Medium 5.3
• CVE-2013-3571 Denial of service in n/a Low 2.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2026-56123, BELL-CVE-2026-56123, DEBIAN-CVE-2026-56123, ECHO-0d27-ed35-8289, GHSA-6r8c-w5mj-43hv, MGASA-2026-0290 and 4 more.