MajorCritical vulnerability

CVE-2026-102521 (CVSS 8.6)

NVD · officialPublished Sep 29, 2026Risk 37/100

The decoder in `readFromDataView` in lib0 before 0.2.119 can be tricked into reading more than it should from a buffer. The vulnerability allows reading past the decoders' view, thus exposing adjacent process memory. This can be anything that is currently in the head, for example credentials or logs. This is similar to but different from GHSA-r5c8-rf4w-qrq8.

Technical details

CVSS

8.6

AV:NetworkAC:LowPR:NoneUI:NoneC:HighI:NoneA:None

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source