CVE-2026-56123: socat Heap-Based Buffer Overflow in SOCKS5 DOMAINNAME Reply Parser
CVE-2026-56123 affects socat versions 1.8.0.0 through 1.8.1.1, where a sign-extension flaw in the DOMAINNAME reply parser can lead to a heap-based buffer overflow when a malicious SOCKS5 proxy server is involved. NVD assigns a CVSS 3.1 base score of 9.8 (critical), and the record shows no CISA KEV listing or EPSS score. The affected range in the record excludes 1.8.1.2 and later, but no fix reference is listed, so administrators should verify the fix against the vendor release notes.
Overview
CVE-2026-56123 is a heap-based buffer overflow (CWE-122) in socat. The record describes it as affecting versions 1.8.0.0 through 1.8.1.1. The flaw is in how socat parses the DOMAINNAME field of a SOCKS5 reply, where a length byte is treated as signed. The record was published on 2026-06-25 and includes an entry from VulnCheck as CNA. NVD lists a base score of 9.8.
Impact
- The record states that a malicious SOCKS5 proxy server can overwrite adjacent heap memory.
- NVD's assessment rates confidentiality, integrity and availability impact as high.
- Because the write is described as unbounded, the most likely consequences include memory corruption, process crashes and, in some environments, code execution. The last of these is an inference and is not stated in the record.
Affected products and versions
- Product listed as Dest-unreach Socat.
- The description names versions 1.8.0.0 through 1.8.1.1.
- The affected range field reads 1.8.0.0 or later and before 1.8.1.2.
- The fixes field is empty, so no fixed version is confirmed in the record. The release notes at CHANGES should be checked.
Exploitation status
The record shows this CVE is not listed in the CISA KEV catalog, and no EPSS score is provided. No confirmed exploitation in the wild appears in the sources consulted for this analysis.
Remediation and mitigation
- Inventory all systems running socat and identify any version between 1.8.0.0 and 1.8.1.1.
- Plan an upgrade to a release that the vendor documents as fixing this issue. Confirm the version in the CHANGES file before deploying.
- Until patching is complete, limit socat to trusted proxy endpoints and avoid routing connections through unknown or untrusted SOCKS servers.
- Reduce exposure by restricting outbound connections from hosts that run socat.
Detection guidance
- Review software inventories and package versions for socat at the level of the affected range.
- Monitor for unexpected crashes or restarts of socat processes, which can indicate memory corruption.
- Audit configuration to identify which proxy servers socat connects to, and flag any unapproved proxy.
Limitations of the available information
- The record has no title, so the title in this analysis is derived from the description.
- No fixed version is listed in the fixes field, so the patched release is unknown from the record alone.
- VulnCheck's advisory is cited in the record, but its content was not reviewed for this analysis beyond the reference link.
- The CVSS 4.0 score of 9.2 and CVSS 3.1 score of 8.1 from VulnCheck differ from the NVD CVSS 3.1 score of 9.8. The reason for the difference is not stated in the record.
- No exploit availability data is provided, and this analysis does not describe exploitation steps.
Frequently asked questions
Which socat versions are affected by CVE-2026-56123?
The record states that socat versions 1.8.0.0 through 1.8.1.1 are affected. The affected range field reads 1.8.0.0 or later and before 1.8.1.2.
Is CVE-2026-56123 known to be exploited?
The record shows the CVE is not listed in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted.
What should administrators do now?
Inventory socat installations, confirm the fixed release in the CHANGES file, plan an upgrade, and limit socat to trusted proxy endpoints until patching is complete.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.