AIKIDO-2026-526379

TL;DR

The UpdateHub client copies server-supplied probe metadata into an unzeroed heap buffer without the terminating NUL byte, so a later strlen() on that buffer can read a few bytes past the end of the allocation. The fallback parse branch is reached when the primary metadata parse fails, which a malicious or compromised update server can force. The over-read walks into adjacent allocator metadata and can only reach a small bounded amount of heap content, with no out-of-bounds write and no disclosure channel back to the caller. The fix zeroes the copy buffer before the copy so the string operations stay within the allocation.