SECURITY ANNOUNCEMENT

CVE-2026-99063

23 October 2026

seven bytes that leak are whatever sat next to the allocation. Clamp data_start to the buffer size. Note that this is not a security bug because the out-of-bounds read can

Introduced

2.6.2576c072b48e39e9291fbf02d6c912cf27d65e093d

Fixed releases

6.12.113e5c3f3d8935ecc64c962fb66e6a86dbf79218f61

6.18.575680b6fb3054677d4ee65d3baba24b649f1b430e

6.6.16098195e822343a656b92e235847ab3e72b1a3f920

7.2.11725b49c689bbb29ef740b0d6b5ea9390baa9a695

7.39b3fcf519d370df94a56f3b272d9eddffffa5be8

View source announcement ↗