AIKIDO-2026-10316
github.com/virustotal/yara-x/go is vulnerable to Use After Free
55
Medium Risk
This Affects:
github.com/virustotal/yara-x/goTL;DR
Affected versions of this package contain a use-after-free vulnerability in the block scanning API. The finish() method can trigger a lazy call to search_for_patterns(), which accesses memory referenced by ScanState::ScanningBlock after it has already been deallocated. This causes crashes or undefined behavior when scanning blocks in a loop, as each block's data is dropped before finish() is called. The patch fixes this by resetting the scan state to Idle after each block scan and managing the pattern_search_done flag explicitly in the host context.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
github.com/virustotal/yara-x/go is vulnerable to Use After Free in versions 0.0.1 - 1.12.0.
How to fix this
Upgrade the github.com/virustotal/yara-x/go library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant