Loading vulnerability…
CVE-2026-53587 is a heap out-of-bounds read in libgit2 smart-protocol packet parsing. In set_data() within the smart packet transport implementation, libgit2 performs a fixed-length comparison for the object-format capability without first confirming that the pkt-line capability buffer contains the required 14 bytes. A malicious refs-advertisement packet can terminate immediately after the object-format prefix, causing the parser to advance beyond the pkt-line. A subsequent delimiter search calculates an underflowed length, resulting in an out-of-bounds heap walk. The flaw affects versions before 1.8.6 and 1.9.5.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Single-file Python exploit for mass exploitation of an Adobe Commerce/Magento issue referenced as APSB25-94. The script is not a framework module; it is a standalone concurrent scanner/exploit tool with CLI options for target list input, thread count, output files, TLS verification disabling, SKU selection, verbosity, and request delay. Its core purpose is to automate exploitation across many hosts by crawling or selecting product targets, then uploading a crafted polyglot GIF that embeds a PHP webshell. The embedded payload is the most important capability: it is a minimal PHP webshell appended to a valid GIF header so the file can masquerade as an image while still executing as PHP if placed in an executable context. Once deployed, the shell supports two functions: command execution through the GET parameter 'c' using system/exec/shell_exec/passthru, and arbitrary file upload through the GET parameter 'up', which renders a multipart upload form and stores uploaded files using move_uploaded_file(). Repository structure is trivial: one Python file containing banner/UI code, HTTP client logic, concurrency via ThreadPoolExecutor, progress display via tqdm, optional requests/colorama support, and result logging. The script writes confirmed shell URLs to success.txt and partial upload-only results to uploaded.txt. It includes SSL-insecure mode, custom User-Agent, and multi-target orchestration, indicating practical offensive use rather than a simple proof-of-concept. Because the payload is hardcoded but functional, maturity is best classified as OPERATIONAL. Notable caveat: the file/banner and docstring contain inconsistent identifiers, mentioning both CVE-2026-53587 and CVE-2026-53787. The exploit clearly intends to target Adobe Commerce/Magento via APSB25-94, but the exact CVE label in the repository appears inconsistent.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An unauthenticated remote heap out-of-bounds read in libgit2 smart-protocol packet processing. A malicious or man-in-the-middle Git server can cause a crash and may expose a large heap-memory window through an error string.
A libgit2 vulnerability covered by Debian advisory DSA-6453 affecting Debian 13/libgit2 packages; the advisory states the issues could lead to arbitrary command execution on a remote SSH server, credential disclosure, denial of service, or directory creation outside a repository working tree.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.