CVE-2026-56123: socat 1.8.0.0 - 1.8.1.1 Heap Buffer Overflow via SOCKS5 Reply Parser

Synopsis

A heap-based buffer overflow affects socat versions 1.8.0.0 through 1.8.1.1 in the SOCKS5 reply parser. The vulnerability is reachable over the network without any authentication, triggered when socat connects through a malicious SOCKS5 proxy server that returns a crafted DOMAINNAME reply. A sign-extension flaw converts a negative domain name length byte into a massive size_t value, causing an unbounded write of attacker-controlled data into heap memory, enabling remote code execution or service disruption. A patched-image rebuild at version 1.8.1.2 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must operate or control a SOCKS5 proxy server that socat connects to over the network, making network-level access to the proxy path a prerequisite.

• AuthenticationNot required

  No authentication credentials are required; the malicious proxy server can trigger the overflow during the unauthenticated SOCKS5 connection handshake.

• Victim interactionNot required

  No user or operator action beyond the normal operation of socat is needed; the overflow occurs automatically during connection setup.

• Attack complexityDetail

  Attack complexity is rated High, meaning the attacker must position a malicious SOCKS5 server in the connection path and craft a precise reply payload to control heap layout and overflow size.

Blast Radius

• An attacker writes arbitrary data of attacker-controlled size into heap memory adjacent to socat's 262-byte reply buffer, overwriting internal heap structures or other allocations.
• Successful heap corruption enables remote code execution in the context of the socat process, which may run with elevated privileges depending on how the host uses it.
• Confidential data passing through the socat relay, including proxied network streams, becomes readable or modifiable by the attacker.
• The socat process can be crashed, interrupting any tunnels, port forwards, or relay connections it is managing.