CVE-2026-88340

A flaw was found in YARA. This invalid pointer release vulnerability occurs during the deserialization of compiled rule files (.yrc). An attacker can exploit this by providing a specially crafted .yrc file, leading to insufficient validation of external-variable pointers. This can result in memory corruption and cause the application to crash, leading to a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, Red Hat customers should avoid processing YARA compiled rule files (.yrc) from untrusted or unverified sources. Ensure that YARA rules are only loaded from trusted locations and that any input files are validated before processing.