CVE-2026-56123
High
Description
socat versions 1.8.0.0 through 1.8.1.1 contain a heap-based buffer overflow vulnerability that allows a malicious SOCKS5 proxy server to overwrite adjacent heap memory by exploiting a sign-extension flaw in the DOMAINNAME reply parser. During connection setup, the domain name length byte is read through a signed char field causing a negative bytes_to_read value that is implicitly converted to size_t, resulting in an unbounded heap write into the 262-byte reply buffer with attacker-controlled size and content.
SeverityHigh
CVSS8.1
Exploit probability—
ProductDest-unreach Socat
PublishedJun 25, 2026
First seenJun 25, 2026
Weakness typeCWE-122CWE-122
How to fix
Update
- dest-unreach socat1.8.1.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dest-unreach socat | 1.8.0.0 ≤ v < 1.8.1.2 | 1.8.1.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.