What is GHSA-q333-36q9-7h8m?

GHSA-q333-36q9-7h8m is a security advisory published by GitHub Security Advisories with Medium severity. A reachable assertion vulnerability exists in YARA 4.5.8 when loading crafted .yrc compiled rule...

Which CVE IDs does GHSA-q333-36q9-7h8m cover?

GHSA-q333-36q9-7h8m covers the following CVE IDs: CVE-2026-88341. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-q333-36q9-7h8m?

GHSA-q333-36q9-7h8m has a CVSS v3 base score of 5.5, published by GitHub Security Advisories.

GHSA-q333-36q9-7h8mMediumCVSS 5.5

A reachable assertion vulnerability exists in YARA 4.5.8 when loading crafted .yrc compiled rule...

Vendor

GitHub Security Advisories

Published

September 22, 2026

Last Modified

September 23, 2026

🔗 CVE IDs covered (1)

CVE-2026-88341 →

📋 Description

A reachable assertion vulnerability exists in YARA 4.5.8 when loading crafted .yrc compiled rule files. An attacker can provide a malicious file with an invalid arena configuration (num_buffers=0) that triggers an assertion failure in yr_arena_get_ptr(), causing the application to terminate.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-88341
https://github.com/VirusTotal/yara/issues/2238
https://github.com/NOUIY/yara/commit/0cdff36723cd260243bb2b330bda555693354760
https://github.com/advisories/GHSA-q333-36q9-7h8m