High severity · published Sep 29, 2026
CVE-2026-63209
Integer Overflow or Wraparound and Out-of-bounds Write in compress
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
compress · klauspost
< 1.18.7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-63209
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-63209
x_refsource_CONFIRM
https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw
x_refsource_MISC
https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536
x_refsource_MISC
https://github.com/klauspost/compress/releases/tag/v1.18.7
More from compress
8.7
CVE-2026-116591
compress zstd: Panic on two-block frames
