CVE-2026-88341: YARA 4.5.8 Denial of Service Vulnerability

CVE-2026-88341 Overview

CVE-2026-88341 is a reachable assertion vulnerability [CWE-617] in YARA 4.5.8, the pattern-matching engine used across malware research and detection pipelines. The flaw occurs when the library loads a crafted .yrc compiled rule file containing an invalid arena configuration where num_buffers=0. This malformed input triggers an assertion failure inside yr_arena_get_ptr(), terminating the host application. The issue affects any tool, service, or automation that consumes untrusted compiled YARA rules.

Critical Impact
An attacker who can supply a malicious .yrc file to a YARA-based scanner can crash the process, disrupting malware analysis workflows, sandboxes, and automated detection pipelines.

Affected Products

YARA version 4.5.8
Applications and services that load untrusted .yrc compiled rule files using libyara
Malware analysis pipelines and sandboxes embedding vulnerable YARA builds

Discovery Timeline

2026-09-22 - CVE-2026-88341 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-88341

Vulnerability Analysis

The vulnerability resides in the arena deserialization logic of libyara. When YARA loads compiled rules, it reconstructs a YR_ARENA structure from the .yrc file, including a num_buffers field describing how many buffer sections the arena contains. The loader does not validate that num_buffers meets the minimum required by the runtime (YR_NUM_SECTIONS).

When downstream code such as yr_rules_from_arena() calls yr_arena_get_ptr() to retrieve section pointers, an internal assertion is reached against the malformed buffer count. The assertion aborts the process rather than returning an error, producing a denial-of-service condition in the host application.

Root Cause

Two related defects contribute to the crash. First, yr_rules_from_arena() accepts arenas with fewer buffers than the number of sections YARA expects to read. Second, the boundary check inside the arena pointer accessor uses buffer_id > arena->num_buffers instead of buffer_id >= arena->num_buffers, permitting a one-past-the-end access that then triggers the reachable assertion downstream.

Attack Vector

Exploitation requires local delivery of a malicious .yrc file and user or automation-driven loading of that file (AV:L, UI:R). No privileges are needed. The impact is limited to availability: the vulnerable process terminates, but confidentiality and integrity are not affected.

// Source: https://github.com/NOUIY/yara/commit/0cdff36723cd260243bb2b330bda555693354760
// Patch in libyara/arena.c - corrects off-by-one in buffer bounds check
     size_t size,
     YR_ARENA_REF* ref)
 {
-  if (buffer_id > arena->num_buffers)
+  if (buffer_id >= arena->num_buffers)
     return ERROR_INVALID_ARGUMENT;
 
   YR_ARENA_BUFFER* b = &arena->buffers[buffer_id];

// Source: https://github.com/NOUIY/yara/commit/0cdff36723cd260243bb2b330bda555693354760
// Patch in libyara/rules.c - rejects arenas with insufficient buffer count
 int yr_rules_from_arena(YR_ARENA* arena, YR_RULES** rules)
 {
+  if (arena->num_buffers < YR_NUM_SECTIONS)
+    return ERROR_CORRUPT_FILE;
+
   YR_SUMMARY* summary = (YR_SUMMARY*) yr_arena_get_ptr(
       arena, YR_SUMMARY_SECTION, 0);

Detection Methods for CVE-2026-88341

Indicators of Compromise

Unexpected termination of YARA-based scanners, sandboxes, or CI jobs immediately after loading a .yrc file
.yrc files originating from untrusted sources or arriving via user upload channels
Assertion failure messages referencing yr_arena_get_ptr in application or crash logs

Detection Strategies

Inspect .yrc file headers for arena metadata reporting num_buffers below the expected YR_NUM_SECTIONS value
Monitor for repeated abnormal exits of processes that embed libyara version 4.5.8
Track the provenance of compiled YARA rules loaded by automated pipelines and treat externally sourced .yrc files as untrusted input

Monitoring Recommendations

Enable core-dump collection on malware analysis hosts to capture assertion aborts for triage
Alert on process crashes correlated with new or externally supplied rule files
Log the SHA-256 hash and source of every .yrc file loaded into production scanners

How to Mitigate CVE-2026-88341

Immediate Actions Required

Upgrade libyara and YARA command-line tools to a version that includes commit 0cdff36723cd260243bb2b330bda555693354760
Restrict which users and services can supply compiled .yrc rule files to production scanners
Recompile source .yar rules locally rather than distributing pre-compiled .yrc artifacts across trust boundaries

Patch Information

The fix is available in the upstream YARA repository via the referenced commit. The patch adds a num_buffers < YR_NUM_SECTIONS guard in yr_rules_from_arena() and corrects the off-by-one boundary check in yr_arena_get_ptr(). See the GitHub YARA commit details and the tracking GitHub YARA issue #2238 for full context.

Workarounds

Accept only .yar source rules from external contributors and compile them in a controlled build environment
Sandbox YARA scanning processes so that a crash does not disrupt broader analysis workflows
Implement automatic restart of scanner processes to preserve availability while patching is scheduled

bash

# Rebuild YARA from a patched source tree
git clone https://github.com/VirusTotal/yara.git
cd yara
git cherry-pick 0cdff36723cd260243bb2b330bda555693354760
./bootstrap.sh && ./configure && make && sudo make install

# Verify the installed version
yara --version