AIKIDO-2026-992567
protobuf is vulnerable to Use-After-Free
76
High Risk
This Affects:
protobufTL;DR
The C++ implementation exposes a JSON parser that can read input delivered as a stream of separate chunks. When untrusted JSON is split across chunk boundaries, the parser reads bytes from a buffer that has already been freed and copies that freed data into an error message. This use-after-free can disclose freed heap memory and destabilize the process. It does not occur when parsing from a single contiguous buffer. The fix corrects buffer lifetime handling so the parser no longer references freed memory.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application uses JsonToBinaryStream() to parse untrusted JSON supplied as separate stream chunks rather than a contiguous buffer.
Background info
protobuf is vulnerable to Use-After-Free in versions 4.22.0 - 4.24.4.
How to fix this
Upgrade the protobuf library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant