The libevent library contains an out-of-bounds read vulnerability that allows unauthenticated attackers to cause a denial of service.

This is an out-of-bounds read (CWE-125) occurring within the event notification library. The vulnerability is exploitable by unauthenticated remote attackers who can trigger the flaw via specifically crafted network traffic.

Successful exploitation of this vulnerability results in high impact to service availability. Because libevent is a foundational library used by many network-facing applications, a crash can lead to significant downtime for critical infrastructure, causing reputational damage and loss of productivity. With a CVSS score of 8.7, this is considered a high-severity issue that requires prompt patching.

Immediate Action: Update the libevent library to version 2.1.13-stable or 2.2.2-alpha as specified by the vendor.

Proactive Monitoring: Monitor application logs for abnormal termination events or repeated service restarts that may indicate exploitation attempts.

Compensating Controls: Deploy network-based intrusion detection systems to identify and block malformed packets that might trigger the out-of-bounds condition.

Public Exploit Available: No (exploit_available: false)

Given the high CVSS score and the widespread use of libevent in network software, organizations should prioritize updating this library across their environment. Immediate patching is the only effective way to eliminate the risk of service disruption caused by this vulnerability.