CVE-2026-102521
lib0 `readFromDataView` out-of-bounds read
CVSS Score
8.6
EPSS Score
0.0%
EPSS Percentile
0th
The decoder in `readFromDataView` in lib0 before 0.2.119 can be tricked into reading more than it should from a buffer. The vulnerability allows reading past the decoders' view, thus exposing adjacent process memory. This can be anything that is currently in the head, for example credentials or logs. This is similar to but different from GHSA-r5c8-rf4w-qrq8.
| CWE | CWE-125 |
| Vendor | dmonad |
| Product | lib0 |
| Published | Sep 29, 2026 |
Stay Ahead of the Next One
Get instant alerts for dmonad lib0
Be the first to know when new high vulnerabilities affecting dmonad lib0 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
dmonad / lib0
<= 0.2.118