Heap Buffer Overflow in e2k Client OP_SERVERMESSAGE Handler (CWE-190/122)

Vulnerability Overview Title: Heap Buffer Overflow in OP_SERVERMESSAGE Handler #445 Description: An unsigned integer underflow vulnerability exists in the function, allowing a remote e2k server to trigger a heap buffer overflow. This results in service denial (crash) and potential remote code execution. Affected Scope Affected Components: - File: - Function: - Case: Vulnerability Details: - When processing incoming packets from e2k servers, the function treats the parameter as a (unsigned 32-bit integer). Upon receiving the opcode, the handler performs the following operations without validating : - The protocol format for server messages is . This implies that a valid message requires . However, no bounds checking is performed on the value. Underflow Scenarios: Attack Vector: - A malicious or compromised e2k server sends a malformed packet with (resulting in in the handler). - Upon receiving this packet after connecting to the server, the client: 1. Allocates a zero-length buffer ( ) 2. Attempts to copy bytes into it → Heap buffer overflow 3. Result: Application crash (at least denial of service); if the heap layout is controllable, arbitrary code execution is possible. Severity: High Risk Assessment: - Attack Complexity: Low — exploitation requires only a malformed packet. - Required Privileges: None — any server can connect and trigger this vulnerability. - User Interaction: Minimal — the user only needs to connect to a malicious server (e2k links or server lists can be directed directly to the client). - Availability Impact: High — crash is guaranteed via heap corruption. - Integrity Impact: Low to Medium — heap corruption may lead to code execution, depending on heap state. - Confidentiality Impact: Low — heap corruption may lead to potential memory leaks. - Scope: Network — any e2k server can connect and trigger this vulnerability. Remediation Fix Measures: - Add a minimum size check in the function, consistent with existing validation patterns in the same function (lines 320, 468, 486): - The is caught by existing blocks, logging the error and closing the connection gracefully instead of crashing. Recommendations: 1. Apply this fix to all active aMule branches. 2. Audit all similar underflow risks involving arithmetic in packet handlers. While was the only one found in , other packet handlers such as , , etc., may have similar issues. 3. Consider fuzzing the function to discover additional edge cases. 4. Consider hardening the connection pipeline to reject untrusted small-size packets before they reach specific opcode handlers. Proof of Concept (POC) Minimal POC: - The provided operates as a TCP server: 1. Accepts an incoming aMule client connection. 2. Sends a valid login response ( ). 3. Sends a malformed with (resulting in ). - Result: The aMule client crashes due to unsigned underflow in the call. Crash Packet Format: Additional Information CVE Number: CVE-2026-51105 Related Activity: - added a commit referencing this issue on April 15. - marked this issue as completed on April 16. - added a commit referencing this issue on April 16. - added a label on May 26. - added a commit referencing this issue 3 days ago. - added a commit referencing this issue 1 day ago. --- Summary: This vulnerability is a critical heap buffer overflow located in the function, triggerable by sending a malformed packet. The remediation involves adding a minimum size check, and further audits and fuzzing are recommended to prevent similar issues.

Goal Reached Thanks to every supporter — we hit 100%!

Heap Buffer Overflow in e2k Client OP_SERVERMESSAGE Handler (CWE-190/122)

More from this source