APITRACE · CVE-2026-126050 · Other
NO FIX YET · SEE WHAT TO DO
apitrace 2.0 through 14.0 trusts the 4-byte chunk length in a Snappy .trace file when reading it into a fixed 1223370-byte heap buffer. A crafted trace file writes past the end of that buffer when dumped, inspected or replayed. The upstream fix is a commit on master; no release after 14.0 is known.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Anyone who runs apitrace versions 2.0 through 14.0 and opens .trace files, including dump, inspect or replay operations. Exposure depends on opening untrusted trace files; sources do not say whether a patched version is released, though a patch link is listed.
Not affected if apitrace-outside-2.0-14.0, no-untrusted-trace-files
Who cares apitrace, graphics-debugging, linux, windows
apitrace 2.0 through 14.0 contains a heap-based buffer overflow in SnappyFile::flushReadCache() that allows attackers to write past m_compressedCache via an oversized compressed chunk length. Attackers can supply a crafted .trace file whose 4-byte chunk length exceeds the fixed buffer size, corrupting heap memory when users dump, inspect, or replay it.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.