{"id":"CVE-2026-126050","kind":"vulnerability","aliases":["CVE-2026-126050"],"related":[],"title":"apitrace: crafted trace file overflows heap buffer when opened","description":"apitrace 2.0 through 14.0 contains a heap-based buffer overflow in SnappyFile::flushReadCache() that allows attackers to write past m_compressedCache via an oversized compressed chunk length. Attackers can supply a crafted .trace file whose 4-byte chunk length exceeds the fixed buffer size, corrupting heap memory when users dump, inspect, or replay it.","summary":"apitrace 2.0 through 14.0 trusts the 4-byte chunk length in a Snappy .trace file when reading it into a fixed 1223370-byte heap buffer. A crafted trace file writes past the end of that buffer when dumped, inspected or replayed. The upstream fix is a commit on master; no release after 14.0 is known.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"apitrace","fixed":[],"affected":">= 2.0, <= 14.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["apitrace","graphics-debugging","linux","other","windows"],"not_affected_if":["apitrace-outside-2.0-14.0","no-untrusted-trace-files"],"how_to_check":"- Run 'apitrace version' (or check your package) : 14.0 and earlier back to 2.0 are affected.\n- If you build from source, check that lib/trace/trace_file_snappy.cpp contains the commit 3890c5a fix.\n- Until patched, do not open .trace files from untrusted sources with apitrace dump, trace, replay or the GUI.","fix":"No released fix yet: latest release 14.0 is affected. The fix is upstream commit 3890c5a448addfd75ccbe1bd09e3075de6fb3395 on apitrace master, which rejects a Snappy chunk length larger than the 1223370-byte compressed cache. Build from master at or after that commit, or wait for a release newer than 14.0.","status":"open","published_at":"2026-11-10T17:17:32+00:00","first_seen_at":"2026-11-10T17:22:41+00:00","triaged_at":"2026-11-10T17:23:55+00:00","updated_at":"2026-11-10T17:26:06+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-10T17:23:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"apitrace: crafted trace file overflows heap buffer when opened","impact":"high","summary":"apitrace, a tool for recording and replaying graphics API calls, has a heap buffer overflow in its Snappy file reader. A crafted .trace file with an oversized chunk length can corrupt memory when a user dumps, inspects or replays it, which can give an attacker code execution on that machine.","audience":"developers","category":"other","nicknames":[],"who_cares":["apitrace","graphics-debugging","linux","windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker corrupts heap memory and may run code on the machine","analyst_note":"Confirm the fixed version from the linked GitHub patch and the VulnCheck advisory; sources do not name one.","how_to_check":"- Check the installed apitrace version against the affected range 2.0 through 14.0.\n- Look for apitrace installs on developer or analyst machines, since the trigger is opening a trace file.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-trace-files","apitrace-outside-2.0-14.0"],"who_is_affected":"Anyone who runs apitrace versions 2.0 through 14.0 and opens .trace files, including dump, inspect or replay operations. Exposure depends on opening untrusted trace files; sources do not say whether a patched version is released, though a patch link is listed.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000738,"input_tokens":4629,"output_tokens":551,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version from the linked GitHub patch and the VulnCheck advisory; sources do not name one.","search":"'-126050':12A,15A '-2026':11A,14A '1223370':45B '14.0':27B,76B,82C '2.0':25B,80C '4':30B,115C 'allow':94C 'apitrac':1A,17B,24B,79C 'apitrace':16A 'attack':95C,107C 'base':87C 'buffer':7A,48B,59B,88C,122C 'byte':31B,46B,116C 'chunk':32B,105C,117C 'commit':70B 'compress':104C 'compressedcach':100C 'contain':83C 'corrupt':124C 'craft':2A,50B,111C 'cve':10A,13A 'debug':20B 'dump':61B,129C 'end':56B 'exceed':119C 'file':4A,38B,52B,113C 'fix':44B,67B,121C 'flushreadcach':92C 'graphic':19B 'graphics-debug':18B 'heap':6A,47B,86C,125C 'heap-bas':85C 'inspect':62B,130C 'known':78B 'length':33B,106C,118C 'linux':21B 'm':99C 'master':72B 'memori':126C 'open':9A 'overflow':5A,89C 'overs':103C 'past':54B,98C 'read':40B 'releas':74B 'replay':64B,132C 'size':123C 'snappi':36B 'snappyfil':91C 'suppli':109C 'trace':3A,37B,51B,112C 'trust':28B 'upstream':66B 'user':128C 'via':101C 'whose':114C 'window':23B 'write':53B,97C","nicknames":[],"mitigations":[],"who_affected":"Anyone who runs apitrace versions 2.0 through 14.0 and opens .trace files, including dump, inspect or replay operations. Exposure depends on opening untrusted trace files; sources do not say whether a patched version is released, though a patch link is listed.","tier":"B","verified":{"fix":{"at":"2026-11-10T17:26:06Z","by":"analyst","doc":"https://github.com/apitrace/apitrace/commit/3890c5a448addfd75ccbe1bd09e3075de6fb3395","run_id":2478}},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["apitrace"],"ptokens":["apitrace"],"labels":["apitrace","graphicsdebugging","high","linux","other","windows"],"campaign_type":null,"search_a":"'-126050':12A,15A '-2026':11A,14A 'apitrac':1A 'apitrace':16A 'buffer':7A 'craft':2A 'cve':10A,13A 'file':4A 'heap':6A 'open':9A 'overflow':5A 'trace':3A","search_b":"'1223370':45B '14.0':27B,76B '2.0':25B '4':30B 'apitrac':17B,24B 'buffer':48B,59B 'byte':31B,46B 'chunk':32B 'commit':70B 'craft':50B 'debug':20B 'dump':61B 'end':56B 'file':38B,52B 'fix':44B,67B 'graphic':19B 'graphics-debug':18B 'heap':47B 'inspect':62B 'known':78B 'length':33B 'linux':21B 'master':72B 'past':54B 'read':40B 'releas':74B 'replay':64B 'snappi':36B 'trace':37B,51B 'trust':28B 'upstream':66B 'window':23B 'write':53B","search_c":"'14.0':82C '2.0':80C '4':115C 'allow':94C 'apitrac':79C 'attack':95C,107C 'base':87C 'buffer':88C,122C 'byte':116C 'chunk':105C,117C 'compress':104C 'compressedcach':100C 'contain':83C 'corrupt':124C 'craft':111C 'dump':129C 'exceed':119C 'file':113C 'fix':121C 'flushreadcach':92C 'heap':86C,125C 'heap-bas':85C 'inspect':130C 'length':106C,118C 'm':99C 'memori':126C 'overflow':89C 'overs':103C 'past':98C 'replay':132C 'size':123C 'snappyfil':91C 'suppli':109C 'trace':112C 'user':128C 'via':101C 'whose':114C 'write':97C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T17:17:32+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126050","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126050","severity":null,"published_at":"2026-11-10T17:17:32+00:00","modified_at":"2026-11-10T17:17:32+00:00","first_seen_at":"2026-11-10T17:22:41+00:00","fetched_at":"2026-11-10T17:22:41+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126050:2478","url":null,"severity":null,"published_at":"2026-11-10T17:26:06+00:00","modified_at":"2026-11-10T17:26:06+00:00","first_seen_at":"2026-11-10T17:26:06+00:00","fetched_at":"2026-11-10T17:26:06+00:00","note":"Maintainer commit 3890c5a (2026-11-10) adds a chunk-length check in lib/trace/trace_file_snappy.cpp; no release after 14.0 found (14.0 tagged 2026-03-10, 18cfd38). VulnCheck lists 2.0-14.0 affected. No exploitation or PoC seen."}],"documents":[{"id":116518,"url":"https://github.com/apitrace/apitrace/commit/3890c5a448addfd75ccbe1bd09e3075de6fb3395","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":116519,"url":"https://www.vulncheck.com/advisories/apitrace-2.0-through-14.0-heap-buffer-overflow-via-snappyfile-flushreadcache","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}