What’s Vulnerable › Vulnerabilities

CVE-2017-8294

• Severity: high (CVSS 7.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-04-27 · updated 2026-06-17
• Weakness: CWE-125

Description

libyara/re.c in the regex component in YARA 3.5.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted rule that is mishandled in the yr_re_exec function.

Affected products

• Yara Object: 3.5.0

References

• http://www.securityfocus.com/bid/98072
• https://github.com/VirusTotal/yara/commit/83d799804648c2a0895d40a19835d9b757c6fa4e
• https://github.com/VirusTotal/yara/issues/646
• http://www.securityfocus.com/bid/98072
• https://github.com/VirusTotal/yara/commit/83d799804648c2a0895d40a19835d9b757c6fa4e
• https://github.com/VirusTotal/yara/issues/646

Get alerted when CVE-2017-8294 or the next vulnerability affects your stack