AIKIDO-2026-197584

TL;DR

The CPython extension binding converts value sizes (mv_size) and key sizes read from LMDB records directly into Python object lengths and allocation sizes without validating them. When an application opens and reads a crafted or corrupted database file, oversized on-disk size fields can overflow size_t arithmetic in the batch-read and sub-database enumeration paths or narrow when cast to Py_ssize_t, producing undersized allocations and out-of-bounds memory access or process crashes. An attacker-supplied database can therefore trigger memory unsafety in the reading process. The fix adds overflow-safe size arithmetic and rejects values that exceed PY_SSIZE_T_MAX before they reach allocation or object-construction code.