CVE-2026-75421: aria2 Stack Buffer Underflow Vulnerability

CVE-2026-75421 Overview

CVE-2026-75421 is a stack-buffer-underflow vulnerability in aria2 version 1.37.0 and earlier. The flaw resides in the IOFile::getLine() function, which reads lines from a file into a stack-allocated buffer. Improper index handling allows the function to access memory below the buffer boundary. aria2 is a widely deployed multi-protocol command-line download utility supporting HTTP, HTTPS, FTP, SFTP, BitTorrent, and Metalink, so the code path is reachable across many integrations and automation scripts.

Critical Impact
An attacker who controls input files parsed by aria2 can trigger out-of-bounds memory access, leading to process crashes or potential memory corruption during download-list or session-file processing.

Affected Products

aria2 version 1.37.0
aria2 versions prior to 1.37.0
Applications and distributions bundling vulnerable aria2 builds

Discovery Timeline

2026-08-25 - CVE-2026-75421 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-75421

Vulnerability Analysis

The vulnerability is a stack-buffer-underflow in the IOFile::getLine() routine of aria2. A stack-buffer-underflow occurs when code reads or writes to memory addresses before the start of a stack-allocated buffer. In IOFile::getLine(), index or pointer arithmetic used to track the current position within the line buffer can reference an offset before the buffer's base address, exposing adjacent stack memory to read or write operations.

The function is invoked during parsing of text-based inputs consumed by aria2, such as URL input lists, session state files, and configuration files. An attacker who controls the contents of these inputs can craft data that steers getLine() into the underflow condition. The direct consequence is memory corruption on the stack, which can crash the process. Depending on compiler layout and stack canary presence, the condition may also influence adjacent variables and control-flow-relevant data.

Root Cause

The root cause is missing bounds validation in the line-reading logic. IOFile::getLine() does not correctly enforce that the read cursor remains at or above the buffer's starting offset before dereferencing memory, allowing arithmetic to produce a negative or pre-base index.

Attack Vector

Exploitation requires aria2 to process attacker-controlled input parsed through IOFile::getLine(). Typical vectors include supplying a malicious URL list via -i, a poisoned session file loaded with --input-file or --save-session, or configuration content read from disk. The vulnerability manifests during file parsing. See GitHub Issue #2375 and GitHub Pull Request #2376 for reproduction context and the proposed fix.

Detection Methods for CVE-2026-75421

Indicators of Compromise

Unexpected crashes or segmentation faults in aria2 processes when parsing input, session, or configuration files.
AddressSanitizer or core-dump reports referencing IOFile::getLine() in the call stack.
Malformed URL lists or session files retrieved from untrusted locations shortly before an aria2 crash.

Detection Strategies

Inventory endpoints and servers running aria2 and flag any build at version 1.37.0 or earlier.
Run aria2 builds under sanitizer instrumentation in test pipelines to surface stack-buffer-underflow signatures.
Correlate process crash telemetry with recent file writes to directories used by aria2 for input lists and session state.

Monitoring Recommendations

Alert on repeated abnormal termination of aria2 processes across managed hosts.
Monitor filesystem changes to aria2 input, session, and configuration paths sourced from external systems.
Log command-line invocations of aria2 including -i, --input-file, --save-session, and --conf-path arguments for forensic review.

How to Mitigate CVE-2026-75421

Immediate Actions Required

Upgrade aria2 to a release that incorporates the fix from GitHub Pull Request #2376.
Restrict aria2 to processing input, session, and configuration files sourced from trusted, authenticated locations only.
Run aria2 under a least-privileged service account to limit the impact of a crash or memory corruption.

Patch Information

A fix is proposed in GitHub Pull Request #2376 against the upstream repository. Track GitHub Issue #2375 and downstream distribution advisories for released package versions that include the patch, then update all affected installations.

Workarounds

Avoid passing untrusted URL lists or session files to aria2 until a patched build is deployed.
Validate and sanitize any file provided via -i, --input-file, or --load-cookies before invocation.
Isolate aria2 execution within a container or sandbox with restricted filesystem and network access.

bash

# Verify installed aria2 version and remove vulnerable builds
aria2c --version | head -n 1

# Example: pin to a patched version via package manager (adjust per distro)
# Debian/Ubuntu
sudo apt-get update && sudo apt-get install --only-upgrade aria2

# Build from source once PR #2376 is merged and tagged
git clone https://github.com/aria2/aria2.git
cd aria2 && git checkout <patched-tag>
autoreconf -i && ./configure && make && sudo make install